@plusscommunities/pluss-newsletter-aws-training 2.0.4-auth.0 → 2.0.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/addNewsletterEntry.js +38 -9
  2. package/config/validVideoURLs.js +46 -0
  3. package/editNewsletterEntry.js +55 -39
  4. package/package-lock.json +245 -1088
  5. package/package.json +4 -9
package/addNewsletterEntry.js CHANGED
@@ -2,11 +2,12 @@ const uuid = require("uuid");
2
2
  const moment = require("moment");
3
3
  const initConfig = require("./initConfig");
4
4
  const { getRowId } = require("./common/helper");
5
+ const { isValidVideo } = require("./config/validVideoURLs");
5
6
  const generateJsonResponse = require("./common/helper/generateJsonResponse");
6
7
  const updateRef = require("./common/db/common/updateRef");
7
8
  const getRef = require("./common/db/common/getRef");
8
9
  const validateMasterAuth = require("./common/helper/auth/validateMasterAuth");
9
- const getSessionUser = require("./common/helper/auth/getSessionUser");
10
+ const getSessionUserFromReqAuthKey = require("@plusscommunities/pluss-core-aws/helper/auth/getSessionUserFromReqAuthKey");
10
11
  const getUserPreview = require("./common/helper/getUserPreview");
11
12
  const sendEmail = require("./common/helper/sendEmail");
12
13
  const newsletterSubmissionEmail = require("./common/templates/newsletterSubmissionEmail");
@@ -55,9 +56,21 @@ module.exports.addNewsletterEntry = (event, context, callback) => {
55
56
  data.update.IsFeaturedDate = null;
56
57
  }
57
58
 
59
+ if (data.update.Video) {
60
+ if (!isValidVideo(data.update.Video)) {
61
+ return callback(
62
+ null,
63
+ generateJsonResponse(400, {
64
+ message:
65
+ "The video URL is from a domain that is not recognized and therefore blocked for security reasons.",
66
+ })
67
+ );
68
+ }
69
+ }
70
+
58
71
  if (data.update.Notification) data.update.UnsentNotification = "X";
59
72
 
60
- getSessionUser(event.headers.authkey).then((uid) => {
73
+ getSessionUserFromReqAuthKey(event).then((uid) => {
61
74
  getUserPreview(uid).then((user) => {
62
75
  data.update.SubmittedBy = user;
63
76
  if (data.update.AuthorDisplay === "name") {
@@ -73,10 +86,8 @@ module.exports.addNewsletterEntry = (event, context, callback) => {
73
86
  console.error("Authorization not valid");
74
87
  callback(
75
88
  null,
76
- generateJsonResponse(422, {
77
- error: {
78
- message: "Authorization not valid.",
79
- },
89
+ generateJsonResponse(403, {
90
+ message: "Authorization not valid.",
80
91
  })
81
92
  );
82
93
  return;
@@ -95,7 +106,13 @@ module.exports.addNewsletterEntry = (event, context, callback) => {
95
106
  );
96
107
  })
97
108
  .catch((error) => {
98
- callback(null, generateJsonResponse(422, { error }));
109
+ console.log("error", error);
110
+ callback(
111
+ null,
112
+ generateJsonResponse(500, {
113
+ message: "Something went wrong.",
114
+ })
115
+ );
99
116
  });
100
117
  } else {
101
118
  updateRef(values.tableNameNewsletterSubmissions, data.update)
@@ -118,7 +135,13 @@ module.exports.addNewsletterEntry = (event, context, callback) => {
118
135
  );
119
136
  })
120
137
  .catch((error) => {
121
- callback(null, generateJsonResponse(422, { error }));
138
+ console.log("error", error);
139
+ callback(
140
+ null,
141
+ generateJsonResponse(500, {
142
+ message: "Something went wrong.",
143
+ })
144
+ );
122
145
  });
123
146
  }
124
147
  }
@@ -145,7 +168,13 @@ module.exports.addNewsletterEntry = (event, context, callback) => {
145
168
  );
146
169
  })
147
170
  .catch((error) => {
148
- callback(null, generateJsonResponse(422, { error }));
171
+ console.log("error", error);
172
+ callback(
173
+ null,
174
+ generateJsonResponse(500, {
175
+ message: "Something went wrong.",
176
+ })
177
+ );
149
178
  });
150
179
  }
151
180
  }
package/config/validVideoURLs.js ADDED
@@ -0,0 +1,46 @@
1
+ const _ = require("lodash");
2
+ const { log } = require("@plusscommunities/pluss-core-aws/helper");
3
+ const { getConfig } = require("@plusscommunities/pluss-core-aws/config");
4
+
5
+ const validVideoURLs = [
6
+ "youtube.com",
7
+ "youtu.be",
8
+ "vimeo.com",
9
+ `${process.env.tablePrefix}uploads.s3.ap-southeast-2.amazonaws.com`,
10
+ ];
11
+
12
+ /**
13
+ *
14
+ * @param {*} videoUrl Url of the video
15
+ * @returns {Boolean} true if the URL is valid. false if it should be blocked.
16
+ */
17
+ exports.isValidVideo = (videoUrl) => {
18
+ const logId = log("isValidVideo", "Start", videoUrl);
19
+ if (_.isEmpty(videoUrl)) {
20
+ log("isValidVideo", "Empty", videoUrl, logId);
21
+ return true;
22
+ }
23
+
24
+ const { featureConfig } = getConfig();
25
+ if (!featureConfig.limitVideoURLs) {
26
+ return true;
27
+ }
28
+ try {
29
+ const host = new URL(videoUrl.toLowerCase()).host;
30
+ log("isValidVideo", "host", host, logId);
31
+
32
+ return _.some(validVideoURLs, (validUrl) => {
33
+ log("isValidVideo", "validUrl", validUrl, logId);
34
+ log(
35
+ "isValidVideo",
36
+ "isValid",
37
+ host === validUrl || host === `www.${validUrl}`,
38
+ logId
39
+ );
40
+ return host === validUrl || host === `www.${validUrl}`;
41
+ });
42
+ } catch (e) {
43
+ log("isValidVideo", "Error", e, logId);
44
+ }
45
+ return false;
46
+ };
package/editNewsletterEntry.js CHANGED
@@ -1,10 +1,12 @@
1
1
  const moment = require("moment");
2
2
  const initConfig = require("./initConfig");
3
+ const { isValidVideo } = require("./config/validVideoURLs");
3
4
  const generateJsonResponse = require("./common/helper/generateJsonResponse");
4
5
  const editRef = require("./common/db/common/editRef");
5
6
  const getRef = require("./common/db/common/getRef");
6
7
  const validateMasterAuth = require("./common/helper/auth/validateMasterAuth");
7
- const getUserPreviewFromHeader = require("./common/helper/getUserPreviewFromHeader");
8
+ const getSessionUserFromReqAuthKey = require("@plusscommunities/pluss-core-aws/helper/auth/getSessionUserFromReqAuthKey");
9
+ const getUserPreview = require("@plusscommunities/pluss-core-aws/helper/getUserPreview");
8
10
  const publishActivity = require("./common/db/activity/publishActivity");
9
11
  const { values } = require("./values.config");
10
12
 
@@ -21,15 +23,25 @@ module.exports.editNewsletterEntry = (event, context, callback) => {
21
23
  Number.MAX_SAFE_INTEGER - data.update.UnixTimestamp;
22
24
  }
23
25
 
26
+ if (data.update.Video) {
27
+ if (!isValidVideo(data.update.Video)) {
28
+ return callback(
29
+ null,
30
+ generateJsonResponse(400, {
31
+ message:
32
+ "The video URL is from a domain that is not recognized and therefore blocked for security reasons.",
33
+ })
34
+ );
35
+ }
36
+ }
37
+
24
38
  validateMasterAuth(event, values.permissionNewsletter).then((authorised) => {
25
39
  if (!authorised) {
26
40
  console.error("Authorization not valid");
27
41
  callback(
28
42
  null,
29
- generateJsonResponse(422, {
30
- error: {
31
- message: "Authorization not valid.",
32
- },
43
+ generateJsonResponse(403, {
44
+ message: "Authorization not valid.",
33
45
  })
34
46
  );
35
47
  return;
@@ -41,51 +53,55 @@ module.exports.editNewsletterEntry = (event, context, callback) => {
41
53
  return callback(
42
54
  null,
43
55
  generateJsonResponse(422, {
44
- error: {
45
- message: "Incorrect site.",
46
- },
56
+ message: "Incorrect site.",
47
57
  })
48
58
  );
49
59
  }
50
- getUserPreviewFromHeader(event.headers.authkey)
51
- .then((user) => {
52
- if (
53
- data.update.AuthorDisplay === "name" &&
54
- result.AuthorDisplay !== "name"
55
- ) {
56
- //list author if change was made
57
- data.update.Author = user;
58
- }
59
- data.update.Changed = moment.utc().unix();
60
- if (data.update.IsFeatured && !data.update.IsFeaturedDate) {
61
- data.update.IsFeaturedDate = moment.utc().unix();
62
- } else if (!data.update.IsFeatured) {
63
- data.update.IsFeaturedDate = null;
64
- }
60
+ getSessionUserFromReqAuthKey(event)
61
+ .then((uid) => {
62
+ getUserPreview(uid).then((user) => {
63
+ if (
64
+ data.update.AuthorDisplay === "name" &&
65
+ result.AuthorDisplay !== "name"
66
+ ) {
67
+ //list author if change was made
68
+ data.update.Author = user;
69
+ }
70
+ data.update.Changed = moment.utc().unix();
71
+ if (data.update.IsFeatured && !data.update.IsFeaturedDate) {
72
+ data.update.IsFeaturedDate = moment.utc().unix();
73
+ } else if (!data.update.IsFeatured) {
74
+ data.update.IsFeaturedDate = null;
75
+ }
65
76
 
66
- editRef(
67
- values.tableNameNewsletterEntries,
68
- "RowId",
69
- data.update.RowId,
70
- data.update
71
- ).then((result) => {
72
- publishActivity(
73
- values.activityEditNews,
74
- data.update.Site,
77
+ editRef(
78
+ values.tableNameNewsletterEntries,
79
+ "RowId",
75
80
  data.update.RowId,
76
- user,
77
- { title: data.update.Title }
81
+ data.update
82
+ ).then((result) => {
83
+ publishActivity(
84
+ values.activityEditNews,
85
+ data.update.Site,
86
+ data.update.RowId,
87
+ user,
88
+ { title: data.update.Title }
89
+ );
90
+ });
91
+ callback(
92
+ null,
93
+ generateJsonResponse(200, { success: true, update: result })
78
94
  );
95
+ return;
79
96
  });
97
+ })
98
+ .catch((error) => {
99
+ console.log(error);
80
100
  callback(
81
101
  null,
82
- generateJsonResponse(200, { success: true, map: result })
102
+ generateJsonResponse(500, { message: "Something went wrong." })
83
103
  );
84
104
  return;
85
- })
86
- .catch((error) => {
87
- callback(null, generateJsonResponse(422, { error }));
88
- return;
89
105
  });
90
106
  }
91
107
  );