diff --git a/src/api/middlewares/Authentication.ts b/src/api/middlewares/Authentication.ts
index b4f484776..f0f01252d 100644
--- a/src/api/middlewares/Authentication.ts
+++ b/src/api/middlewares/Authentication.ts
@@ -32,7 +32,7 @@ export const NO_AUTHORIZATION_ROUTES = [
"POST /auth/reset",
"GET /invites/",
// Routes with a seperate auth system
- /^(POST|HEAD) \/webhooks\/\d+\/\w+\/?/, // no token requires auth
+ /^(POST|HEAD|GET|PATCH|DELETE) \/webhooks\/\d+\/\w+\/?/, // no token requires auth
// Public information endpoints
"GET /ping",
"GET /gateway",
diff --git a/src/api/routes/channels/#channel_id/webhooks.ts b/src/api/routes/channels/#channel_id/webhooks.ts
index 2060760d5..0df53a86d 100644
--- a/src/api/routes/channels/#channel_id/webhooks.ts
+++ b/src/api/routes/channels/#channel_id/webhooks.ts
@@ -28,6 +28,8 @@ import {
handleFile,
isTextChannel,
trimSpecial,
+ FieldErrors,
+ ValidateName,
} from "@spacebar/util";
import crypto from "crypto";
import { Request, Response, Router } from "express";
@@ -111,8 +113,9 @@ router.post(
name = trimSpecial(name);
// TODO: move this
- if (name === "clyde") throw new HTTPError("Invalid name", 400);
- if (name === "Spacebar Ghost") throw new HTTPError("Invalid name", 400);
+ if (name) {
+ ValidateName(name);
+ }
if (avatar) avatar = await handleFile(`/avatars/${channel_id}`, avatar);
diff --git a/src/api/routes/policies/instance/config.ts b/src/api/routes/policies/instance/config.ts
new file mode 100755
index 000000000..6cd1dc2dd
--- /dev/null
+++ b/src/api/routes/policies/instance/config.ts
@@ -0,0 +1,74 @@
+/*
+ Spacebar: A FOSS re-implementation and extension of the Discord.com backend.
+ Copyright (C) 2023 Spacebar and Spacebar Contributors
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published
+ by the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import { route } from "@spacebar/api";
+import { Config, getRights } from "@spacebar/util";
+import { Request, Response, Router } from "express";
+
+const router = Router();
+
+router.get(
+ "/",
+ route({
+ responses: {
+ 200: {
+ body: "Object",
+ },
+ },
+ }),
+ async (req: Request, res: Response) => {
+ const general = Config.get();
+ let outputtedConfig;
+ if (req.user_id) {
+ const rights = await getRights(req.user_id);
+ if (rights.has("OPERATOR")) outputtedConfig = general;
+ } else {
+ outputtedConfig = {
+ limits_user_maxGuilds: general.limits.user.maxGuilds,
+ limits_user_maxBio: general.limits.user.maxBio,
+ limits_guild_maxEmojis: general.limits.guild.maxEmojis,
+ limits_guild_maxRoles: general.limits.guild.maxRoles,
+ limits_message_maxCharacters:
+ general.limits.message.maxCharacters,
+ limits_message_maxAttachmentSize:
+ general.limits.message.maxAttachmentSize,
+ limits_message_maxEmbedDownloadSize:
+ general.limits.message.maxEmbedDownloadSize,
+ limits_channel_maxWebhooks: general.limits.channel.maxWebhooks,
+ register_dateOfBirth_requiredc:
+ general.register.dateOfBirth.required,
+ register_password_required: general.register.password.required,
+ register_disabled: general.register.disabled,
+ register_requireInvite: general.register.requireInvite,
+ register_allowNewRegistration:
+ general.register.allowNewRegistration,
+ register_allowMultipleAccounts:
+ general.register.allowMultipleAccounts,
+ guild_autoJoin_canLeave: general.guild.autoJoin.canLeave,
+ guild_autoJoin_guilds_x: general.guild.autoJoin.guilds,
+ register_email_required: general.register.email.required,
+ can_recover_account:
+ general.email.provider != null &&
+ general.general.frontPage != null,
+ };
+ }
+ res.send(outputtedConfig);
+ },
+);
+
+export default router;
diff --git a/src/api/routes/webhooks/#webhook_id/#token/index.ts b/src/api/routes/webhooks/#webhook_id/#token/index.ts
index 8e0ad0dd3..0de43af3b 100644
--- a/src/api/routes/webhooks/#webhook_id/#token/index.ts
+++ b/src/api/routes/webhooks/#webhook_id/#token/index.ts
@@ -10,6 +10,10 @@ import {
WebhookExecuteSchema,
emitEvent,
uploadFile,
+ WebhooksUpdateEvent,
+ WebhookUpdateSchema,
+ handleFile,
+ ValidateName,
} from "@spacebar/util";
import { Request, Response, Router } from "express";
import { HTTPError } from "lambert-server";
@@ -129,13 +133,8 @@ router.post(
// block username from containing certain words
// TODO: configurable additions
- const blockedContains = ["discord", "clyde", "spacebar"];
- for (const word of blockedContains) {
- if (body.username?.toLowerCase().includes(word)) {
- return res.status(400).json({
- username: [`Username cannot contain "${word}"`],
- });
- }
+ if (body.username) {
+ ValidateName(body.username);
}
// block username from being certain words
@@ -248,4 +247,109 @@ router.post(
},
);
+router.delete(
+ "/",
+ route({
+ responses: {
+ 204: {},
+ 400: {
+ body: "APIErrorResponse",
+ },
+ 404: {},
+ },
+ }),
+ async (req: Request, res: Response) => {
+ const { webhook_id, token } = req.params;
+
+ const webhook = await Webhook.findOne({
+ where: {
+ id: webhook_id,
+ },
+ relations: ["channel", "guild", "application"],
+ });
+
+ if (!webhook) {
+ throw DiscordApiErrors.UNKNOWN_WEBHOOK;
+ }
+
+ if (webhook.token !== token) {
+ throw DiscordApiErrors.INVALID_WEBHOOK_TOKEN_PROVIDED;
+ }
+ const channel_id = webhook.channel_id;
+ await Webhook.delete({ id: webhook_id });
+
+ await emitEvent({
+ event: "WEBHOOKS_UPDATE",
+ channel_id,
+ data: {
+ channel_id,
+ guild_id: webhook.guild_id,
+ },
+ } as WebhooksUpdateEvent);
+
+ res.sendStatus(204);
+ },
+);
+
+router.patch(
+ "/",
+ route({
+ requestBody: "WebhookUpdateSchema",
+ responses: {
+ 200: {
+ body: "Message",
+ },
+ 400: {
+ body: "APIErrorResponse",
+ },
+ 403: {},
+ 404: {},
+ },
+ }),
+ async (req: Request, res: Response) => {
+ const { webhook_id, token } = req.params;
+ const body = req.body as WebhookUpdateSchema;
+
+ const webhook = await Webhook.findOneOrFail({
+ where: { id: webhook_id },
+ relations: [
+ "user",
+ "channel",
+ "source_channel",
+ "guild",
+ "source_guild",
+ "application",
+ ],
+ });
+ const channel_id = webhook.channel_id;
+ if (!body.name && !body.avatar) {
+ throw new HTTPError("Empty webhook updates are not allowed", 50006);
+ }
+ if (body.avatar)
+ body.avatar = await handleFile(
+ `/avatars/${webhook_id}`,
+ body.avatar as string,
+ );
+
+ if (body.name) {
+ ValidateName(body.name);
+ }
+
+ webhook.assign(body);
+
+ await Promise.all([
+ webhook.save(),
+ emitEvent({
+ event: "WEBHOOKS_UPDATE",
+ channel_id,
+ data: {
+ channel_id,
+ guild_id: webhook.guild_id,
+ },
+ } as WebhooksUpdateEvent),
+ ]);
+ res.status(204);
+ },
+);
+
export default router;
diff --git a/src/api/routes/webhooks/#webhook_id/index.ts b/src/api/routes/webhooks/#webhook_id/index.ts
index 59fdb76df..baedc7f0d 100644
--- a/src/api/routes/webhooks/#webhook_id/index.ts
+++ b/src/api/routes/webhooks/#webhook_id/index.ts
@@ -4,8 +4,16 @@ import {
DiscordApiErrors,
getPermission,
Webhook,
+ WebhooksUpdateEvent,
+ emitEvent,
+ WebhookUpdateSchema,
+ Channel,
+ handleFile,
+ FieldErrors,
+ ValidateName,
} from "@spacebar/util";
import { Request, Response, Router } from "express";
+import { HTTPError } from "lambert-server";
const router = Router();
router.get(
@@ -54,4 +62,139 @@ router.get(
},
);
+router.delete(
+ "/",
+ route({
+ responses: {
+ 204: {},
+ 400: {
+ body: "APIErrorResponse",
+ },
+ 404: {},
+ },
+ }),
+ async (req: Request, res: Response) => {
+ const { webhook_id } = req.params;
+
+ const webhook = await Webhook.findOneOrFail({
+ where: { id: webhook_id },
+ relations: [
+ "user",
+ "channel",
+ "source_channel",
+ "guild",
+ "source_guild",
+ "application",
+ ],
+ });
+
+ if (webhook.guild_id) {
+ const permission = await getPermission(
+ req.user_id,
+ webhook.guild_id,
+ );
+
+ if (!permission.has("MANAGE_WEBHOOKS"))
+ throw DiscordApiErrors.UNKNOWN_WEBHOOK;
+ } else if (webhook.user_id != req.user_id)
+ throw DiscordApiErrors.UNKNOWN_WEBHOOK;
+
+ const channel_id = webhook.channel_id;
+ await Webhook.delete({ id: webhook_id });
+
+ await emitEvent({
+ event: "WEBHOOKS_UPDATE",
+ channel_id,
+ data: {
+ channel_id,
+ guild_id: webhook.guild_id,
+ },
+ } as WebhooksUpdateEvent);
+
+ res.sendStatus(204);
+ },
+);
+
+router.patch(
+ "/",
+ route({
+ requestBody: "WebhookUpdateSchema",
+ responses: {
+ 200: {
+ body: "WebhookCreateResponse",
+ },
+ 400: {
+ body: "APIErrorResponse",
+ },
+ 403: {},
+ 404: {},
+ },
+ }),
+ async (req: Request, res: Response) => {
+ const { webhook_id } = req.params;
+ const body = req.body as WebhookUpdateSchema;
+
+ const webhook = await Webhook.findOneOrFail({
+ where: { id: webhook_id },
+ relations: [
+ "user",
+ "channel",
+ "source_channel",
+ "guild",
+ "source_guild",
+ "application",
+ ],
+ });
+
+ if (webhook.guild_id) {
+ const permission = await getPermission(
+ req.user_id,
+ webhook.guild_id,
+ );
+
+ if (!permission.has("MANAGE_WEBHOOKS"))
+ throw DiscordApiErrors.UNKNOWN_WEBHOOK;
+ } else if (webhook.user_id != req.user_id)
+ throw DiscordApiErrors.UNKNOWN_WEBHOOK;
+
+ if (!body.name && !body.avatar && !body.channel_id) {
+ throw new HTTPError("Empty webhook updates are not allowed", 50006);
+ }
+
+ if (body.avatar)
+ body.avatar = await handleFile(
+ `/avatars/${webhook_id}`,
+ body.avatar as string,
+ );
+
+ if (body.name) {
+ ValidateName(body.name);
+ }
+
+ const channel_id = body.channel_id || webhook.channel_id;
+ webhook.assign(body);
+
+ if (body.channel_id)
+ webhook.assign({
+ channel: await Channel.findOneOrFail({
+ where: { id: channel_id },
+ }),
+ });
+
+ await Promise.all([
+ webhook.save(),
+ emitEvent({
+ event: "WEBHOOKS_UPDATE",
+ channel_id,
+ data: {
+ channel_id,
+ guild_id: webhook.guild_id,
+ },
+ } as WebhooksUpdateEvent),
+ ]);
+
+ res.json(webhook);
+ },
+);
+
export default router;
|
