@plusscommunities/pluss-newsletter-aws-sharing 2.0.4-beta.0 → 2.0.4

package/addNewsletterEntry.js

@@ -2,11 +2,12 @@ const uuid = require("uuid");
 const moment = require("moment");
 const initConfig = require("./initConfig");
 const { getRowId } = require("./common/helper");
+const { isValidVideo } = require("./config/validVideoURLs");
 const generateJsonResponse = require("./common/helper/generateJsonResponse");
 const updateRef = require("./common/db/common/updateRef");
 const getRef = require("./common/db/common/getRef");
 const validateMasterAuth = require("./common/helper/auth/validateMasterAuth");
-const getSessionUser = require("./common/helper/auth/getSessionUser");
+const getSessionUserFromReqAuthKey = require("@plusscommunities/pluss-core-aws/helper/auth/getSessionUserFromReqAuthKey");
 const getUserPreview = require("./common/helper/getUserPreview");
 const sendEmail = require("./common/helper/sendEmail");
 const newsletterSubmissionEmail = require("./common/templates/newsletterSubmissionEmail");
@@ -55,9 +56,21 @@ module.exports.addNewsletterEntry = (event, context, callback) => {
     data.update.IsFeaturedDate = null;
   }
 
+  if (data.update.Video) {
+    if (!isValidVideo(data.update.Video)) {
+      return callback(
+        null,
+        generateJsonResponse(400, {
+          message:
+            "The video URL is from a domain that is not recognized and therefore blocked for security reasons.",
+        })
+      );
+    }
+  }
+
   if (data.update.Notification) data.update.UnsentNotification = "X";
 
-  getSessionUser(event.headers.authkey).then((uid) => {
+  getSessionUserFromReqAuthKey(event).then((uid) => {
     getUserPreview(uid).then((user) => {
       data.update.SubmittedBy = user;
       if (data.update.AuthorDisplay === "name") {
@@ -73,10 +86,8 @@ module.exports.addNewsletterEntry = (event, context, callback) => {
                   console.error("Authorization not valid");
                   callback(
                     null,
-                    generateJsonResponse(422, {
-                      error: {
-                        message: "Authorization not valid.",
-                      },
+                    generateJsonResponse(403, {
+                      message: "Authorization not valid.",
                     })
                   );
                   return;
@@ -95,7 +106,13 @@ module.exports.addNewsletterEntry = (event, context, callback) => {
                       );
                     })
                     .catch((error) => {
-                      callback(null, generateJsonResponse(422, { error }));
+                      console.log("error", error);
+                      callback(
+                        null,
+                        generateJsonResponse(500, {
+                          message: "Something went wrong.",
+                        })
+                      );
                     });
                 } else {
                   updateRef(values.tableNameNewsletterSubmissions, data.update)
@@ -118,7 +135,13 @@ module.exports.addNewsletterEntry = (event, context, callback) => {
                       );
                     })
                     .catch((error) => {
-                      callback(null, generateJsonResponse(422, { error }));
+                      console.log("error", error);
+                      callback(
+                        null,
+                        generateJsonResponse(500, {
+                          message: "Something went wrong.",
+                        })
+                      );
                     });
                 }
               }
@@ -145,7 +168,13 @@ module.exports.addNewsletterEntry = (event, context, callback) => {
                 );
               })
               .catch((error) => {
-                callback(null, generateJsonResponse(422, { error }));
+                console.log("error", error);
+                callback(
+                  null,
+                  generateJsonResponse(500, {
+                    message: "Something went wrong.",
+                  })
+                );
               });
           }
         }

package/config/validVideoURLs.js

@@ -0,0 +1,46 @@
+const _ = require("lodash");
+const { log } = require("@plusscommunities/pluss-core-aws/helper");
+const { getConfig } = require("@plusscommunities/pluss-core-aws/config");
+
+const validVideoURLs = [
+  "youtube.com",
+  "youtu.be",
+  "vimeo.com",
+  `${process.env.tablePrefix}uploads.s3.ap-southeast-2.amazonaws.com`,
+];
+
+/**
+ *
+ * @param {*} videoUrl Url of the video
+ * @returns {Boolean} true if the URL is valid. false if it should be blocked.
+ */
+exports.isValidVideo = (videoUrl) => {
+  const logId = log("isValidVideo", "Start", videoUrl);
+  if (_.isEmpty(videoUrl)) {
+    log("isValidVideo", "Empty", videoUrl, logId);
+    return true;
+  }
+
+  const { featureConfig } = getConfig();
+  if (!featureConfig.limitVideoURLs) {
+    return true;
+  }
+  try {
+    const host = new URL(videoUrl.toLowerCase()).host;
+    log("isValidVideo", "host", host, logId);
+
+    return _.some(validVideoURLs, (validUrl) => {
+      log("isValidVideo", "validUrl", validUrl, logId);
+      log(
+        "isValidVideo",
+        "isValid",
+        host === validUrl || host === `www.${validUrl}`,
+        logId
+      );
+      return host === validUrl || host === `www.${validUrl}`;
+    });
+  } catch (e) {
+    log("isValidVideo", "Error", e, logId);
+  }
+  return false;
+};

package/editNewsletterEntry.js

@@ -1,10 +1,12 @@
 const moment = require("moment");
 const initConfig = require("./initConfig");
+const { isValidVideo } = require("./config/validVideoURLs");
 const generateJsonResponse = require("./common/helper/generateJsonResponse");
 const editRef = require("./common/db/common/editRef");
 const getRef = require("./common/db/common/getRef");
 const validateMasterAuth = require("./common/helper/auth/validateMasterAuth");
-const getUserPreviewFromHeader = require("./common/helper/getUserPreviewFromHeader");
+const getSessionUserFromReqAuthKey = require("@plusscommunities/pluss-core-aws/helper/auth/getSessionUserFromReqAuthKey");
+const getUserPreview = require("@plusscommunities/pluss-core-aws/helper/getUserPreview");
 const publishActivity = require("./common/db/activity/publishActivity");
 const { values } = require("./values.config");
 
@@ -21,15 +23,25 @@ module.exports.editNewsletterEntry = (event, context, callback) => {
       Number.MAX_SAFE_INTEGER - data.update.UnixTimestamp;
   }
 
+  if (data.update.Video) {
+    if (!isValidVideo(data.update.Video)) {
+      return callback(
+        null,
+        generateJsonResponse(400, {
+          message:
+            "The video URL is from a domain that is not recognized and therefore blocked for security reasons.",
+        })
+      );
+    }
+  }
+
   validateMasterAuth(event, values.permissionNewsletter).then((authorised) => {
     if (!authorised) {
       console.error("Authorization not valid");
       callback(
         null,
-        generateJsonResponse(422, {
-          error: {
-            message: "Authorization not valid.",
-          },
+        generateJsonResponse(403, {
+          message: "Authorization not valid.",
         })
       );
       return;
@@ -41,51 +53,55 @@ module.exports.editNewsletterEntry = (event, context, callback) => {
           return callback(
             null,
             generateJsonResponse(422, {
-              error: {
-                message: "Incorrect site.",
-              },
+              message: "Incorrect site.",
             })
           );
         }
-        getUserPreviewFromHeader(event.headers.authkey)
-          .then((user) => {
-            if (
-              data.update.AuthorDisplay === "name" &&
-              result.AuthorDisplay !== "name"
-            ) {
-              //list author if change was made
-              data.update.Author = user;
-            }
-            data.update.Changed = moment.utc().unix();
-            if (data.update.IsFeatured && !data.update.IsFeaturedDate) {
-              data.update.IsFeaturedDate = moment.utc().unix();
-            } else if (!data.update.IsFeatured) {
-              data.update.IsFeaturedDate = null;
-            }
+        getSessionUserFromReqAuthKey(event)
+          .then((uid) => {
+            getUserPreview(uid).then((user) => {
+              if (
+                data.update.AuthorDisplay === "name" &&
+                result.AuthorDisplay !== "name"
+              ) {
+                //list author if change was made
+                data.update.Author = user;
+              }
+              data.update.Changed = moment.utc().unix();
+              if (data.update.IsFeatured && !data.update.IsFeaturedDate) {
+                data.update.IsFeaturedDate = moment.utc().unix();
+              } else if (!data.update.IsFeatured) {
+                data.update.IsFeaturedDate = null;
+              }
 
-            editRef(
-              values.tableNameNewsletterEntries,
-              "RowId",
-              data.update.RowId,
-              data.update
-            ).then((result) => {
-              publishActivity(
-                values.activityEditNews,
-                data.update.Site,
+              editRef(
+                values.tableNameNewsletterEntries,
+                "RowId",
                 data.update.RowId,
-                user,
-                { title: data.update.Title }
+                data.update
+              ).then((result) => {
+                publishActivity(
+                  values.activityEditNews,
+                  data.update.Site,
+                  data.update.RowId,
+                  user,
+                  { title: data.update.Title }
+                );
+              });
+              callback(
+                null,
+                generateJsonResponse(200, { success: true, update: result })
               );
+              return;
             });
+          })
+          .catch((error) => {
+            console.log(error);
             callback(
               null,
-              generateJsonResponse(200, { success: true, map: result })
+              generateJsonResponse(500, { message: "Something went wrong." })
             );
             return;
-          })
-          .catch((error) => {
-            callback(null, generateJsonResponse(422, { error }));
-            return;
           });
       }
     );

package/feature.config.js

@@ -13,3 +13,303 @@ exports.entity = {
   webPath: values.routeEntityPath,
   appPath: values.screenNewsletterPost,
 };
+
+exports.serverless = {
+  name: values.serviceKey,
+  apis: [
+    {
+      name: "addNewsletterEntry",
+      file: "addNewsletterEntry",
+      function: "addNewsletterEntry",
+      memorySize: 1024,
+      timeout: 30,
+      path: "add",
+      method: "post",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "editNewsletterEntry",
+      file: "editNewsletterEntry",
+      function: "editNewsletterEntry",
+      memorySize: 128,
+      timeout: 10,
+      path: "edit",
+      method: "post",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "editNewsletterSubmission",
+      file: "editNewsletterSubmission",
+      function: "editNewsletterSubmission",
+      memorySize: 128,
+      timeout: 10,
+      path: "editSubmission",
+      method: "post",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getNewsletterEntry",
+      file: "getNewsletterEntry",
+      function: "getNewsletterEntry",
+      memorySize: 128,
+      timeout: 10,
+      path: "get/{id}",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getNews",
+      file: "getNews",
+      function: "getNews",
+      memorySize: 128,
+      timeout: 10,
+      path: "get2/{action}",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getNewsletterEntries",
+      file: "getNewsletterEntries",
+      function: "getNewsletterEntries",
+      memorySize: 1024,
+      timeout: 30,
+      path: "get",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getFeaturedNewsletterEntries",
+      file: "getFeaturedNewsletterEntries",
+      function: "getFeaturedNewsletterEntries",
+      memorySize: 128,
+      timeout: 10,
+      path: "getFeatured",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getRecentNewsletterEntries",
+      file: "getRecentNewsletterEntries",
+      function: "getRecentNewsletterEntries",
+      memorySize: 128,
+      timeout: 10,
+      path: "recent",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "searchAvailableNews",
+      file: "searchAvailableNews",
+      function: "searchAvailableNews",
+      memorySize: 128,
+      timeout: 10,
+      path: "content/search",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getAvailableNews",
+      file: "getAvailableNews",
+      function: "getAvailableNews",
+      memorySize: 128,
+      timeout: 10,
+      path: "content/get",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getPublishedEntries",
+      file: "getPublishedEntries",
+      function: "getPublishedEntries",
+      memorySize: 128,
+      timeout: 10,
+      path: "content/specific",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getPublishedAvailableNews",
+      file: "getPublishedAvailableNews",
+      function: "getPublishedAvailableNews",
+      memorySize: 128,
+      timeout: 10,
+      path: "content/published",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "deleteNewsletterEntry",
+      file: "deleteNewsletterEntry",
+      function: "deleteNewsletterEntry",
+      memorySize: 128,
+      timeout: 10,
+      path: "remove",
+      method: "post",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "hasNewsletterAccess",
+      file: "hasNewsletterAccess",
+      function: "hasNewsletterAccess",
+      memorySize: 128,
+      timeout: 10,
+      path: "access",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getNewsletterSubmissions",
+      file: "getNewsletterSubmissions",
+      function: "getNewsletterSubmissions",
+      memorySize: 128,
+      timeout: 10,
+      path: "submissions/get",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getNewsletterSubmission",
+      file: "getNewsletterSubmission",
+      function: "getNewsletterSubmission",
+      memorySize: 128,
+      timeout: 10,
+      path: "submissions/get/{id}",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "handleNewsletterSubmission",
+      file: "handleNewsletterSubmission",
+      function: "handleNewsletterSubmission",
+      memorySize: 128,
+      timeout: 10,
+      path: "submissions/handle",
+      method: "post",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getSubmissionCount",
+      file: "getSubmissionCount",
+      function: "getSubmissionCount",
+      memorySize: 128,
+      timeout: 10,
+      path: "submissions/count",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getTaggedNews",
+      file: "getTaggedNews",
+      function: "getTaggedNews",
+      memorySize: 128,
+      timeout: 10,
+      path: "tagged/get",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+  ],
+  triggers: [
+    {
+      name: "newsletterChanged",
+      file: "newsletterChanged",
+      function: "newsletterChanged",
+      memorySize: 2048,
+      timeout: 30,
+      table: values.tableKeyNewsletterEntries,
+    },
+  ],
+  schedules: [
+    {
+      name: "watchNewsletter",
+      file: "watchNewsletter",
+      function: "watchNewsletter",
+      memorySize: "2048",
+      timeout: "300",
+      rate: "1/5 * * * ? *",
+    },
+  ],
+  tables: [
+    {
+      key: values.tableKeyNewsletterEntries,
+      name: values.tableNameNewsletterEntries,
+      attributes: [
+        { name: "RowId", type: "S" },
+        { name: "Site", type: "S" },
+        { name: "UnixTimestampReverse", type: "N" },
+        { name: "FeaturedExpiry", type: "N" },
+        { name: "SourceId", type: "S" },
+        { name: "UnsentNotification", type: "S" },
+        { name: "UnixTimestamp", type: "N" },
+      ],
+      id: "RowId",
+      indexes: [
+        {
+          name: "NewsletterEntriesSiteTimestampIndex",
+          keys: [
+            { name: "Site", type: "HASH" },
+            { name: "UnixTimestampReverse", type: "RANGE" },
+          ],
+        },
+        {
+          name: "NewsletterEntriesSiteFeaturedExpiryIndex",
+          keys: [
+            { name: "Site", type: "HASH" },
+            { name: "FeaturedExpiry", type: "RANGE" },
+          ],
+        },
+        {
+          name: "NewsletterEntriesSiteSourceIdIndex",
+          keys: [
+            { name: "Site", type: "HASH" },
+            { name: "SourceId", type: "RANGE" },
+          ],
+        },
+        {
+          name: "NewsletterEntriesUnsentNotiIndex",
+          keys: [
+            { name: "UnsentNotification", type: "HASH" },
+            { name: "UnixTimestamp", type: "RANGE" },
+          ],
+        },
+      ],
+    },
+    {
+      key: values.tableKeyNewsletterSubmissions,
+      name: values.tableNameNewsletterSubmissions,
+      attributes: [
+        { name: "RowId", type: "S" },
+        { name: "Site", type: "S" },
+        { name: "UnixTimestampReverse", type: "N" },
+      ],
+      id: "RowId",
+      indexes: [
+        {
+          name: "NewsletterSubmissionsSiteTimestampIndex",
+          keys: [
+            { name: "Site", type: "HASH" },
+            { name: "UnixTimestampReverse", type: "RANGE" },
+          ],
+        },
+      ],
+    },
+    {
+      key: values.tableKeyNewsletterUserEntries,
+      name: values.tableNameNewsletterUserEntries,
+      attributes: [
+        { name: "RowId", type: "S" },
+        { name: "UserId", type: "S" },
+        { name: "UnixTimestampReverse", type: "N" },
+      ],
+      id: "RowId",
+      indexes: [
+        {
+          name: "NewsletterUserEntriesUserIdTimestampIndex",
+          keys: [
+            { name: "UserId", type: "HASH" },
+            { name: "UnixTimestampReverse", type: "RANGE" },
+          ],
+        },
+      ],
+    },
+  ],
+};