Security: check bot ownership when resetting token

2 files changed, 12 insertions, 8 deletions

diff --git a/src/api/routes/applications/#application_id/bot/index.ts b/src/api/routes/applications/#application_id/bot/index.ts

index c25649bb..f37792db 100644
--- a/src/api/routes/applications/#application_id/bot/index.ts
+++ b/src/api/routes/applications/#application_id/bot/index.ts
@@ -66,18 +66,18 @@ router.post(
         },
     }),
     async (req: Request, res: Response) => {
-        const bot = await User.findOneOrFail({ where: { id: req.params.application_id as string, bot: true } });
-        const owner = req.user;
+        const botApplication = await Application.findOneOrFail({ where: { id: req.params.application_id as string }, relations: { bot: true } });
 
-        if (owner.id != req.user_id) throw DiscordApiErrors.ACTION_NOT_AUTHORIZED_ON_APPLICATION;
+        // TODO: handle teams
+        if (botApplication.owner_id != req.user_id) throw DiscordApiErrors.ACTION_NOT_AUTHORIZED_ON_APPLICATION;
 
-        if (owner.totp_secret && (!req.body.code || verifyToken(owner.totp_secret, req.body.code))) throw new HTTPError(req.t("auth:login.INVALID_TOTP_CODE"), 60008);
+        const botOwner = await User.findOneOrFail({ where: { id: botApplication.owner_id } });
+        if (botOwner.totp_secret && (!req.body.code || verifyToken(botOwner.totp_secret, req.body.code))) throw new HTTPError(req.t("auth:login.INVALID_TOTP_CODE"), 60008);
 
-        bot.data = { hash: undefined, valid_tokens_since: new Date() };
+        botApplication.bot!.data = { hash: undefined, valid_tokens_since: new Date() };
+        await botApplication.bot!.save();
 
-        await bot.save();
-
-        const token = await generateToken(bot.id);
+        const token = await generateToken(botApplication.id);
 
         res.json({ token }).status(200);
     },
diff --git a/src/util/entities/Application.ts b/src/util/entities/Application.ts

index c4f40343..8b857f14 100644
--- a/src/util/entities/Application.ts
+++ b/src/util/entities/Application.ts
@@ -57,6 +57,10 @@ export class Application extends BaseClass {
     @ManyToOne(() => User, { onDelete: "CASCADE" })
     owner: User;
 
+    @Column()
+    @RelationId((application: Application) => application.owner)
+    owner_id: string;
+
     // TODO: enum this? https://discord.com/developers/docs/resources/application#application-object-application-flags
     @Column()
     flags: number = 0;