161sh/trashposs
1
0
Fork 0
mirror of https://iceshrimp.dev/crimekillz/trashposs synced 2024-11-22 00:43:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

added more selective control over users show endpoint

Browse Source
This commit is contained in:
Alexis 2023-11-08 16:03:03 -05:00 committed by Laura Hausmann
parent 84e8e095ec
commit 76db23855c
No known key found for this signature in database
GPG Key ID: D044E84C5BE01605
2 changed files with 41 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
packages/backend/src/models/repositories/user.ts
View File

@ -372,12 +372,14 @@ export const UserRepository = db.getRepository(User).extend({
options?: {
detail?: D;
includeSecrets?: boolean;
isPrivateMode?: boolean;
},
): Promise<IsMeAndIsUserDetailed<ExpectsMe, D>> {
const opts = Object.assign(
{
detail: false,
includeSecrets: false,
isPrivateMode: false
},
options,
);
@ -442,6 +444,30 @@ export const UserRepository = db.getRepository(User).extend({
const falsy = opts.detail ? false : undefined;
if (opts.isPrivateMode) {
const packed = {
id: user.id,
username: user.username,
host: user.host,
...(opts.detail
? {
twoFactorEnabled: profile!.twoFactorEnabled,
usePasswordLessLogin: profile!.usePasswordLessLogin,
securityKeys: profile!.twoFactorEnabled
? UserSecurityKeys.countBy({
userId: user.id,
}).then((result) => result >= 1)
: false,
}
: {}),
} as Promiseable<Packed<"User">> as Promiseable<
IsMeAndIsUserDetailed<ExpectsMe, D>
>;
return await awaitAll(packed);
}
const packed = {
id: user.id,
name: user.name,

9
packages/backend/src/server/api/endpoints/users/show.ts
View File

@ -6,12 +6,14 @@ import type { User } from "@/models/entities/user.js";
import define from "../../define.js";
import { apiLogger } from "../../logger.js";
import { ApiError } from "../../error.js";
import { fetchMeta } from "@/misc/fetch-meta.js";
export const meta = {
tags: ["users"],
// TODO: determine if should allow this in private mode or to create a new endpoint just for 2fa
requireCredential: false,
requireCredentialPrivateMode: true,
requireCredentialPrivateMode: false, // set to false to allow FIDO2 and other 2fa auth
description: "Show the properties of a user.",
@ -146,8 +148,13 @@ export default define(meta, paramDef, async (ps, me) => {
throw new ApiError(meta.errors.noSuchUser);
}
// apiLogger.debug(`packed (detailed): ${JSON.stringify(await Users.pack(user, me, {detail: true}))}`);
// apiLogger.debug(`packed (private): ${JSON.stringify(await Users.pack(user, me, {detail: true, isPrivateMode: true}))}`);
const serverMeta = await fetchMeta();
return await Users.pack(user, me, {
detail: true,
isPrivateMode: me !== null ? false : serverMeta.privateMode
});
}
});