rhythia-api 143.0.0 → 145.0.0

package/api/createBeatmap.ts

@@ -9,8 +9,8 @@ const s3Client = new S3Client({
   region: "auto",
   endpoint: "https://s3.eu-central-003.backblazeb2.com",
   credentials: {
-    secretAccessKey: "K0039mm4iKsteQOXpZSzf0+VDzuH89U",
-    accessKeyId: "003c245e893e8060000000001",
+    secretAccessKey: process.env.SECRET_BUCKET || "",
+    accessKeyId: process.env.ACCESS_BUCKET || "",
   },
 });
 
@@ -63,6 +63,20 @@ export async function handler({
     return NextResponse.json({ error: "Bad user" });
   }
 
+  if (
+    userData.ban == "excluded" ||
+    userData.ban == "restricted" ||
+    userData.ban == "silenced"
+  ) {
+    return NextResponse.json(
+      {
+        error:
+          "Silenced, restricted or excluded players can't update their profile.",
+      },
+      { status: 404 }
+    );
+  }
+
   let { data: beatmapPage, error: errorlast } = await supabase
     .from("beatmapPages")
     .select(`*`)

package/api/createBeatmapPage.ts

@@ -36,6 +36,20 @@ export async function handler({
 
   if (!userData) return NextResponse.json({ error: "No user." });
 
+  if (
+    userData.ban == "excluded" ||
+    userData.ban == "restricted" ||
+    userData.ban == "silenced"
+  ) {
+    return NextResponse.json(
+      {
+        error:
+          "Silenced, restricted or excluded players can't update their profile.",
+      },
+      { status: 404 }
+    );
+  }
+  
   const upserted = await supabase
     .from("beatmapPages")
     .upsert({

package/api/getAvatarUploadUrl.ts

@@ -9,13 +9,14 @@ import {
   S3Client,
 } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+import { validateIntrinsicToken } from "../utils/validateToken";
 
 const s3Client = new S3Client({
   region: "auto",
   endpoint: "https://s3.eu-central-003.backblazeb2.com",
   credentials: {
-    secretAccessKey: "K0039mm4iKsteQOXpZSzf0+VDzuH89U",
-    accessKeyId: "003c245e893e8060000000001",
+    secretAccessKey: process.env.SECRET_BUCKET || "",
+    accessKeyId: process.env.ACCESS_BUCKET || "",
   },
 });
 
@@ -24,6 +25,7 @@ export const Schema = {
     session: z.string(),
     contentLength: z.number(),
     contentType: z.string(),
+    intrinsicToken: z.string(),
   }),
   output: z.strictObject({
     error: z.string().optional(),
@@ -45,11 +47,18 @@ export async function handler({
   session,
   contentLength,
   contentType,
+  intrinsicToken,
 }: (typeof Schema)["input"]["_type"]): Promise<
   NextResponse<(typeof Schema)["output"]["_type"]>
 > {
   const user = (await supabase.auth.getUser(session)).data.user!;
 
+  if (!validateIntrinsicToken(intrinsicToken)) {
+    return NextResponse.json({
+      error: "Invalid intrinsic token",
+    });
+  }
+
   if (contentLength > 5000000) {
     return NextResponse.json({
       error: "Max content length exceeded.",

package/api/getMapUploadUrl.ts

@@ -9,13 +9,14 @@ import {
   S3Client,
 } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+import { validateIntrinsicToken } from "../utils/validateToken";
 
 const s3Client = new S3Client({
   region: "auto",
   endpoint: "https://s3.eu-central-003.backblazeb2.com",
   credentials: {
-    secretAccessKey: "K0039mm4iKsteQOXpZSzf0+VDzuH89U",
-    accessKeyId: "003c245e893e8060000000001",
+    secretAccessKey: process.env.SECRET_BUCKET || "",
+    accessKeyId: process.env.ACCESS_BUCKET || "",
   },
 });
 
@@ -25,6 +26,7 @@ export const Schema = {
     session: z.string(),
     contentLength: z.number(),
     contentType: z.string(),
+    intrinsicToken: z.string(),
   }),
   output: z.strictObject({
     error: z.string().optional(),
@@ -47,17 +49,30 @@ export async function handler({
   session,
   contentLength,
   contentType,
+  intrinsicToken,
 }: (typeof Schema)["input"]["_type"]): Promise<
   NextResponse<(typeof Schema)["output"]["_type"]>
 > {
   const user = (await supabase.auth.getUser(session)).data.user!;
 
+  if (!validateIntrinsicToken(intrinsicToken)) {
+    return NextResponse.json({
+      error: "Invalid intrinsic token",
+    });
+  }
+
   if (contentLength > 50000000) {
     return NextResponse.json({
       error: "Max content length exceeded.",
     });
   }
 
+  if (contentType !== "application/octet-stream") {
+    return NextResponse.json({
+      error: "Unnacceptable format",
+    });
+  }
+
   const key = `rhythia-${mapName ? mapName : user.id}-${Date.now()}.sspm`;
   const command = new PutObjectCommand({
     Bucket: "rhthia-avatars",

package/api/getProfile.ts

@@ -8,7 +8,7 @@ import { supabase } from "../utils/supabase";
 export const Schema = {
   input: z.strictObject({
     session: z.string(),
-    id: z.number().optional(),
+    id: z.number().nullable().optional(),
   }),
   output: z.object({
     error: z.string().optional(),
@@ -51,7 +51,7 @@ export async function handler(
   let profiles: Database["public"]["Tables"]["profiles"]["Row"][] = [];
 
   // Fetch by id
-  if (data.id !== undefined) {
+  if (data.id !== undefined && data.id !== null) {
     let { data: queryData, error } = await supabase
       .from("profiles")
       .select("*")

package/api/submitScore.ts

@@ -50,6 +50,12 @@ export async function handler({
 }: (typeof Schema)["input"]["_type"]): Promise<
   NextResponse<(typeof Schema)["output"]["_type"]>
 > {
+  return NextResponse.json(
+    {
+      error: "Disabled",
+    },
+    { status: 500 }
+  );
   const user = (await supabase.auth.getUser(session)).data.user!;
 
   let { data: userData, error: userError } = await supabase