rhythia-api 229.0.0 → 231.0.0

package/utils/getUserBySession.ts

@@ -4,7 +4,7 @@ import { supabase } from "./supabase";
 
 export async function getUserBySession(session: string): Promise<User | null> {
   const user = (await supabase.auth.getUser(session)).data.user;
-
+  console.log("session:", session);
   if (user) {
     return user;
   }

package/utils/requestUtils.ts

@@ -1,88 +1,127 @@
-import { NextResponse } from "next/server";
-import { set, ZodObject } from "zod";
-import { getUserBySession } from "./getUserBySession";
-import { supabase } from "./supabase";
-
-interface Props<
-  K = (...args: any[]) => Promise<NextResponse<any>>,
-  T = ZodObject<any>,
-> {
-  request: Request;
-  schema: { input: T; output: T };
-  authorization?: Function;
-  activity: K;
-}
-
-export async function protectedApi({
-  request,
-  schema,
-  authorization,
-  activity,
-}: Props) {
-  try {
-    const toParse = await request.json();
-    const data = schema.input.parse(toParse);
-
-    const dataClone = structuredClone(data);
-    if (dataClone) {
-      if (dataClone["token"]) {
-        dataClone["token"] = "********";
-      }
-      Object.keys(dataClone).forEach((key) => {
-        console.log("KEY: ", key, dataClone[key]);
-        if (key == "data") {
-          try {
-            Object.keys(dataClone[key]).forEach((key2) => {
-              console.log("KEY2: ", key2, dataClone[key][key2]);
-            });
-          } catch (error) {}
-        }
-      });
-    }
-
-    setActivity(data);
-    if (authorization) {
-      const authorizationResponse = await authorization(data);
-      if (authorizationResponse) {
-        return authorizationResponse;
-      }
-    }
-    return await activity(data, request);
-  } catch (error) {
-    console.log(`Couldn't parse`, error.toString());
-    return NextResponse.json({ error: error.toString() }, { status: 400 });
-  }
-}
-
-export async function setActivity(data: Record<string, any>) {
-  if (data.session) {
-    const user = (await supabase.auth.getUser(data.session)).data.user;
-    if (user) {
-      await supabase.from("profileActivities").upsert({
-        uid: user.id,
-        last_activity: Date.now(),
-      });
-    }
-  }
-}
-
-export async function validUser(data) {
-  if (!data.session) {
-    return NextResponse.json(
-      {
-        error: "Session is missing",
-      },
-      { status: 501 }
-    );
-  }
-
-  const user = await getUserBySession(data.session);
-  if (!user) {
-    return NextResponse.json(
-      {
-        error: "Invalid user session",
-      },
-      { status: 400 }
-    );
-  }
-}
+import { NextResponse } from "next/server";
+import { ZodObject } from "zod";
+import { getUserBySession } from "./getUserBySession";
+import { supabase } from "./supabase";
+
+const SENSITIVE_LOG_KEYS = new Set([
+  "session",
+  "replayBytes",
+  "token",
+  "secret",
+  "passkey",
+  "passKey",
+]);
+const LONG_LOG_STRING_THRESHOLD = 256;
+
+function sanitizeForLog(
+  value: unknown,
+  key?: string
+):
+  | string
+  | number
+  | boolean
+  | null
+  | undefined
+  | Record<string, unknown>
+  | unknown[] {
+  const normalizedKey = (key || "").toLowerCase();
+  if (
+    SENSITIVE_LOG_KEYS.has(key || "") ||
+    SENSITIVE_LOG_KEYS.has(normalizedKey)
+  ) {
+    if (value === null || value === undefined) {
+      return value as null | undefined;
+    }
+    return "<Long>";
+  }
+
+  if (typeof value === "string") {
+    return value.length > LONG_LOG_STRING_THRESHOLD ? "<Long>" : value;
+  }
+
+  if (Array.isArray(value)) {
+    return value.map((item) => sanitizeForLog(item));
+  }
+
+  if (value && typeof value === "object") {
+    const sanitizedObject: Record<string, unknown> = {};
+    Object.entries(value as Record<string, unknown>).forEach(
+      ([entryKey, entryValue]) => {
+        sanitizedObject[entryKey] = sanitizeForLog(entryValue, entryKey);
+      }
+    );
+    return sanitizedObject;
+  }
+
+  return value as string | number | boolean | null | undefined;
+}
+
+interface Props<
+  K = (...args: any[]) => Promise<NextResponse<any>>,
+  T = ZodObject<any>,
+> {
+  request: Request;
+  schema: { input: T; output: T };
+  authorization?: Function;
+  activity: K;
+}
+
+export async function protectedApi({
+  request,
+  schema,
+  authorization,
+  activity,
+}: Props) {
+  try {
+    const toParse = await request.json();
+    const data = schema.input.parse(toParse);
+
+    console.log("Request payload:", sanitizeForLog(data));
+
+    setActivity(data);
+    if (authorization) {
+      const authorizationResponse = await authorization(data);
+      if (authorizationResponse) {
+        return authorizationResponse;
+      }
+    }
+    return await activity(data, request);
+  } catch (error) {
+    console.log(`Couldn't parse`, error.toString());
+    return NextResponse.json({ error: error.toString() }, { status: 400 });
+  }
+}
+
+export async function setActivity(data: Record<string, any>) {
+  if (data.session) {
+    const user = (await supabase.auth.getUser(data.session)).data.user;
+    if (user) {
+      await supabase.from("profileActivities").upsert({
+        uid: user.id,
+        last_activity: Date.now(),
+      });
+    }
+  }
+}
+
+export async function validUser(data) {
+  if (!data.session) {
+    return NextResponse.json(
+      {
+        error: "Session is missing",
+      },
+      { status: 501 }
+    );
+  }
+
+  const user = await getUserBySession(data.session);
+  if (!user) {
+    console.log("Invalid user session");
+    return NextResponse.json(
+      {
+        error: "Invalid user session",
+      },
+      { status: 401 }
+    );
+  }
+}