@openneuro/server 4.15.2-demo.1 → 4.16.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openneuro/server",
-  "version": "4.15.2-demo.1",
+  "version": "4.16.1",
   "description": "Core service for the OpenNeuro platform.",
   "license": "MIT",
   "main": "src/server.js",
@@ -17,7 +17,7 @@
   "dependencies": {
     "@apollo/client": "3.7.2",
     "@elastic/elasticsearch": "7.15.0",
-    "@openneuro/search": "^4.15.2-demo.1",
+    "@openneuro/search": "^4.16.1",
     "@passport-next/passport-google-oauth2": "^1.0.0",
     "@sentry/node": "^4.5.3",
     "apollo-server": "2.25.4",
@@ -92,5 +92,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "38094ea1b60e11a55425dbe597a10d872a4cb89e"
+  "gitHead": "0739211264d035ff4531bf7961232c1abd0165d5"
 }

package/src/graphql/permissions.js

@@ -1,3 +1,5 @@
+import config from '../config.js'
+import { ApolloError } from 'apollo-server'
 import Permission from '../models/permission'
 import Dataset from '../models/dataset'
 import Deletion from '../models/deletion'
@@ -50,12 +52,37 @@ export const checkPermissionLevel = (permission, state) => {
   }
 }
 
+export class DeletedDatasetError extends ApolloError {
+  constructor(datasetId, reason, redirect = undefined) {
+    let extension
+    if (redirect) {
+      try {
+        // Validate URL before we attach it to the API response
+        const canonical = new URL(config.url)
+        const url = new URL(redirect)
+        if (
+          url.hostname === canonical.hostname &&
+          url.pathname.startsWith('/datasets')
+        ) {
+          // Only return a relative path to avoid cross site risks
+          extension = { redirect: url.pathname }
+        }
+      } catch (err) {
+        // Do nothing
+      }
+    }
+    super(
+      `Dataset ${datasetId} has been deleted. Reason: ${reason}.`,
+      'DELETED_DATASET',
+      extension,
+    )
+  }
+}
+
 export const checkDatasetExists = async datasetId => {
   const deleted = await Deletion.findOne({ datasetId }).exec()
   if (deleted) {
-    throw new Error(
-      `Dataset ${datasetId} has been deleted. Reason: ${deleted.reason}.`,
-    )
+    throw new DeletedDatasetError(datasetId, deleted.reason, deleted.redirect)
   }
   const found = await Dataset.countDocuments({ id: datasetId }).exec()
   if (!found) throw new Error(`Dataset ${datasetId} does not exist.`)

package/src/graphql/resolvers/brainlife.ts

@@ -41,8 +41,11 @@ export const onBrainlife = async (
   dataset: DatasetOrSnapshot,
 ): Promise<boolean> => {
   try {
+    const abortController = new AbortController()
     const url = brainlifeQuery(dataset)
-    const res = await fetch(url.toString())
+    const timeout = setTimeout(() => abortController.abort(), 5000)
+    const res = await fetch(url.toString(), { signal: abortController.signal })
+    clearTimeout(timeout)
     const body = await res.json()
     if (Array.isArray(body) && body.length) {
       return true