@plusscommunities/pluss-newsletter-aws 2.0.2-beta.0 → 2.0.2

package/addNewsletterEntry.js

@@ -2,11 +2,12 @@ const uuid = require("uuid");
 const moment = require("moment");
 const initConfig = require("./initConfig");
 const { getRowId } = require("./common/helper");
+const { isValidVideo } = require("./config/validVideoURLs");
 const generateJsonResponse = require("./common/helper/generateJsonResponse");
 const updateRef = require("./common/db/common/updateRef");
 const getRef = require("./common/db/common/getRef");
 const validateMasterAuth = require("./common/helper/auth/validateMasterAuth");
-const getSessionUser = require("./common/helper/auth/getSessionUser");
+const getSessionUserFromReqAuthKey = require("@plusscommunities/pluss-core-aws/helper/auth/getSessionUserFromReqAuthKey");
 const getUserPreview = require("./common/helper/getUserPreview");
 const sendEmail = require("./common/helper/sendEmail");
 const newsletterSubmissionEmail = require("./common/templates/newsletterSubmissionEmail");
@@ -55,9 +56,21 @@ module.exports.addNewsletterEntry = (event, context, callback) => {
     data.update.IsFeaturedDate = null;
   }
 
+  if (data.update.Video) {
+    if (!isValidVideo(data.update.Video)) {
+      return callback(
+        null,
+        generateJsonResponse(400, {
+          message:
+            "The video URL is from a domain that is not recognized and therefore blocked for security reasons.",
+        })
+      );
+    }
+  }
+
   if (data.update.Notification) data.update.UnsentNotification = "X";
 
-  getSessionUser(event.headers.authkey).then((uid) => {
+  getSessionUserFromReqAuthKey(event).then((uid) => {
     getUserPreview(uid).then((user) => {
       data.update.SubmittedBy = user;
       if (data.update.AuthorDisplay === "name") {
@@ -73,10 +86,8 @@ module.exports.addNewsletterEntry = (event, context, callback) => {
                   console.error("Authorization not valid");
                   callback(
                     null,
-                    generateJsonResponse(422, {
-                      error: {
-                        message: "Authorization not valid.",
-                      },
+                    generateJsonResponse(403, {
+                      message: "Authorization not valid.",
                     })
                   );
                   return;
@@ -95,7 +106,13 @@ module.exports.addNewsletterEntry = (event, context, callback) => {
                       );
                     })
                     .catch((error) => {
-                      callback(null, generateJsonResponse(422, { error }));
+                      console.log("error", error);
+                      callback(
+                        null,
+                        generateJsonResponse(500, {
+                          message: "Something went wrong.",
+                        })
+                      );
                     });
                 } else {
                   updateRef(values.tableNameNewsletterSubmissions, data.update)
@@ -118,7 +135,13 @@ module.exports.addNewsletterEntry = (event, context, callback) => {
                       );
                     })
                     .catch((error) => {
-                      callback(null, generateJsonResponse(422, { error }));
+                      console.log("error", error);
+                      callback(
+                        null,
+                        generateJsonResponse(500, {
+                          message: "Something went wrong.",
+                        })
+                      );
                     });
                 }
               }
@@ -145,7 +168,13 @@ module.exports.addNewsletterEntry = (event, context, callback) => {
                 );
               })
               .catch((error) => {
-                callback(null, generateJsonResponse(422, { error }));
+                console.log("error", error);
+                callback(
+                  null,
+                  generateJsonResponse(500, {
+                    message: "Something went wrong.",
+                  })
+                );
               });
           }
         }

package/config/validVideoURLs.js

@@ -0,0 +1,40 @@
+const _ = require("lodash");
+const { log } = require("@plusscommunities/pluss-core-aws/helper");
+
+const validVideoURLs = [
+  "youtube.com",
+  "youtu.be",
+  "vimeo.com",
+  `${process.env.tablePrefix}uploads.s3.ap-southeast-2.amazonaws.com`,
+];
+
+/**
+ *
+ * @param {*} videoUrl Url of the video
+ * @returns {Boolean} true if the URL is valid. false if it should be blocked.
+ */
+exports.isValidVideo = (videoUrl) => {
+  const logId = log("isValidVideo", "Start", videoUrl);
+  if (_.isEmpty(videoUrl)) {
+    log("isValidVideo", "Empty", videoUrl, logId);
+    return true;
+  }
+  try {
+    const host = new URL(videoUrl.toLowerCase()).host;
+    log("isValidVideo", "host", host, logId);
+
+    return _.some(validVideoURLs, (validUrl) => {
+      log("isValidVideo", "validUrl", validUrl, logId);
+      log(
+        "isValidVideo",
+        "isValid",
+        host === validUrl || host === `www.${validUrl}`,
+        logId
+      );
+      return host === validUrl || host === `www.${validUrl}`;
+    });
+  } catch (e) {
+    log("isValidVideo", "Error", e, logId);
+  }
+  return false;
+};

package/editNewsletterEntry.js

@@ -1,5 +1,6 @@
 const moment = require("moment");
 const initConfig = require("./initConfig");
+const { isValidVideo } = require("./config/validVideoURLs");
 const generateJsonResponse = require("./common/helper/generateJsonResponse");
 const editRef = require("./common/db/common/editRef");
 const getRef = require("./common/db/common/getRef");
@@ -21,15 +22,25 @@ module.exports.editNewsletterEntry = (event, context, callback) => {
       Number.MAX_SAFE_INTEGER - data.update.UnixTimestamp;
   }
 
+  if (data.update.Video) {
+    if (!isValidVideo(data.update.Video)) {
+      return callback(
+        null,
+        generateJsonResponse(400, {
+          message:
+            "The video URL is from a domain that is not recognized and therefore blocked for security reasons.",
+        })
+      );
+    }
+  }
+
   validateMasterAuth(event, values.permissionNewsletter).then((authorised) => {
     if (!authorised) {
       console.error("Authorization not valid");
       callback(
         null,
-        generateJsonResponse(422, {
-          error: {
-            message: "Authorization not valid.",
-          },
+        generateJsonResponse(403, {
+          message: "Authorization not valid.",
         })
       );
       return;
@@ -41,9 +52,7 @@ module.exports.editNewsletterEntry = (event, context, callback) => {
           return callback(
             null,
             generateJsonResponse(422, {
-              error: {
-                message: "Incorrect site.",
-              },
+              message: "Incorrect site.",
             })
           );
         }
@@ -84,7 +93,11 @@ module.exports.editNewsletterEntry = (event, context, callback) => {
             return;
           })
           .catch((error) => {
-            callback(null, generateJsonResponse(422, { error }));
+            console.log(error);
+            callback(
+              null,
+              generateJsonResponse(500, { message: "Something went wrong." })
+            );
             return;
           });
       }

package/feature.config.js

@@ -13,3 +13,303 @@ exports.entity = {
   webPath: values.routeEntityPath,
   appPath: values.screenNewsletterPost,
 };
+
+exports.serverless = {
+  name: values.serviceKey,
+  apis: [
+    {
+      name: "addNewsletterEntry",
+      file: "addNewsletterEntry",
+      function: "addNewsletterEntry",
+      memorySize: 1024,
+      timeout: 30,
+      path: "add",
+      method: "post",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "editNewsletterEntry",
+      file: "editNewsletterEntry",
+      function: "editNewsletterEntry",
+      memorySize: 128,
+      timeout: 10,
+      path: "edit",
+      method: "post",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "editNewsletterSubmission",
+      file: "editNewsletterSubmission",
+      function: "editNewsletterSubmission",
+      memorySize: 128,
+      timeout: 10,
+      path: "editSubmission",
+      method: "post",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getNewsletterEntry",
+      file: "getNewsletterEntry",
+      function: "getNewsletterEntry",
+      memorySize: 128,
+      timeout: 10,
+      path: "get/{id}",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getNews",
+      file: "getNews",
+      function: "getNews",
+      memorySize: 128,
+      timeout: 10,
+      path: "get2/{action}",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getNewsletterEntries",
+      file: "getNewsletterEntries",
+      function: "getNewsletterEntries",
+      memorySize: 1024,
+      timeout: 30,
+      path: "get",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getFeaturedNewsletterEntries",
+      file: "getFeaturedNewsletterEntries",
+      function: "getFeaturedNewsletterEntries",
+      memorySize: 128,
+      timeout: 10,
+      path: "getFeatured",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getRecentNewsletterEntries",
+      file: "getRecentNewsletterEntries",
+      function: "getRecentNewsletterEntries",
+      memorySize: 128,
+      timeout: 10,
+      path: "recent",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "searchAvailableNews",
+      file: "searchAvailableNews",
+      function: "searchAvailableNews",
+      memorySize: 128,
+      timeout: 10,
+      path: "content/search",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getAvailableNews",
+      file: "getAvailableNews",
+      function: "getAvailableNews",
+      memorySize: 128,
+      timeout: 10,
+      path: "content/get",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getPublishedEntries",
+      file: "getPublishedEntries",
+      function: "getPublishedEntries",
+      memorySize: 128,
+      timeout: 10,
+      path: "content/specific",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getPublishedAvailableNews",
+      file: "getPublishedAvailableNews",
+      function: "getPublishedAvailableNews",
+      memorySize: 128,
+      timeout: 10,
+      path: "content/published",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "deleteNewsletterEntry",
+      file: "deleteNewsletterEntry",
+      function: "deleteNewsletterEntry",
+      memorySize: 128,
+      timeout: 10,
+      path: "remove",
+      method: "post",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "hasNewsletterAccess",
+      file: "hasNewsletterAccess",
+      function: "hasNewsletterAccess",
+      memorySize: 128,
+      timeout: 10,
+      path: "access",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getNewsletterSubmissions",
+      file: "getNewsletterSubmissions",
+      function: "getNewsletterSubmissions",
+      memorySize: 128,
+      timeout: 10,
+      path: "submissions/get",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getNewsletterSubmission",
+      file: "getNewsletterSubmission",
+      function: "getNewsletterSubmission",
+      memorySize: 128,
+      timeout: 10,
+      path: "submissions/get/{id}",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "handleNewsletterSubmission",
+      file: "handleNewsletterSubmission",
+      function: "handleNewsletterSubmission",
+      memorySize: 128,
+      timeout: 10,
+      path: "submissions/handle",
+      method: "post",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getSubmissionCount",
+      file: "getSubmissionCount",
+      function: "getSubmissionCount",
+      memorySize: 128,
+      timeout: 10,
+      path: "submissions/count",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+    {
+      name: "getTaggedNews",
+      file: "getTaggedNews",
+      function: "getTaggedNews",
+      memorySize: 128,
+      timeout: 10,
+      path: "tagged/get",
+      method: "get",
+      headers: ["Content-Type", "authkey", "apikey"],
+    },
+  ],
+  triggers: [
+    {
+      name: "newsletterChanged",
+      file: "newsletterChanged",
+      function: "newsletterChanged",
+      memorySize: 2048,
+      timeout: 30,
+      table: values.tableKeyNewsletterEntries,
+    },
+  ],
+  schedules: [
+    {
+      name: "watchNewsletter",
+      file: "watchNewsletter",
+      function: "watchNewsletter",
+      memorySize: "2048",
+      timeout: "300",
+      rate: "1/5 * * * ? *",
+    },
+  ],
+  tables: [
+    {
+      key: values.tableKeyNewsletterEntries,
+      name: values.tableNameNewsletterEntries,
+      attributes: [
+        { name: "RowId", type: "S" },
+        { name: "Site", type: "S" },
+        { name: "UnixTimestampReverse", type: "N" },
+        { name: "FeaturedExpiry", type: "N" },
+        { name: "SourceId", type: "S" },
+        { name: "UnsentNotification", type: "S" },
+        { name: "UnixTimestamp", type: "N" },
+      ],
+      id: "RowId",
+      indexes: [
+        {
+          name: "NewsletterEntriesSiteTimestampIndex",
+          keys: [
+            { name: "Site", type: "HASH" },
+            { name: "UnixTimestampReverse", type: "RANGE" },
+          ],
+        },
+        {
+          name: "NewsletterEntriesSiteFeaturedExpiryIndex",
+          keys: [
+            { name: "Site", type: "HASH" },
+            { name: "FeaturedExpiry", type: "RANGE" },
+          ],
+        },
+        {
+          name: "NewsletterEntriesSiteSourceIdIndex",
+          keys: [
+            { name: "Site", type: "HASH" },
+            { name: "SourceId", type: "RANGE" },
+          ],
+        },
+        {
+          name: "NewsletterEntriesUnsentNotiIndex",
+          keys: [
+            { name: "UnsentNotification", type: "HASH" },
+            { name: "UnixTimestamp", type: "RANGE" },
+          ],
+        },
+      ],
+    },
+    {
+      key: values.tableKeyNewsletterSubmissions,
+      name: values.tableNameNewsletterSubmissions,
+      attributes: [
+        { name: "RowId", type: "S" },
+        { name: "Site", type: "S" },
+        { name: "UnixTimestampReverse", type: "N" },
+      ],
+      id: "RowId",
+      indexes: [
+        {
+          name: "NewsletterSubmissionsSiteTimestampIndex",
+          keys: [
+            { name: "Site", type: "HASH" },
+            { name: "UnixTimestampReverse", type: "RANGE" },
+          ],
+        },
+      ],
+    },
+    {
+      key: values.tableKeyNewsletterUserEntries,
+      name: values.tableNameNewsletterUserEntries,
+      attributes: [
+        { name: "RowId", type: "S" },
+        { name: "UserId", type: "S" },
+        { name: "UnixTimestampReverse", type: "N" },
+      ],
+      id: "RowId",
+      indexes: [
+        {
+          name: "NewsletterUserEntriesUserIdTimestampIndex",
+          keys: [
+            { name: "UserId", type: "HASH" },
+            { name: "UnixTimestampReverse", type: "RANGE" },
+          ],
+        },
+      ],
+    },
+  ],
+};