mirror of
https://github.com/nestriness/nestri.git
synced 2026-09-19 17:25:19 +03:00
40b4270161
A single secret that turned any request into an operator was the only credential several routes accepted, and it had no caller left: the device pairing it existed for is on hold, and nothing in this tree or any client sent it. What remained was a key that bypassed authentication entirely, required to boot, and checked by nobody. Every route behind it had a better answer available: - Library and game sync move to host credentials. Both took a `userId` in the body, which meant one secret could write into anybody's library. A host now says which of its enrolled users a batch is for, and that claim is checked against the Steam sign-ins it actually holds — one box carries several people's accounts, so the pair is the unit. - Download-state reporting narrows to hosts alone, and the body that could name a different host is gone. Which host is reporting comes from its own credentials, and a body that still names one is refused rather than ignored. - Linking a Steam account is always for the caller. - Creating a game by hand is deleted; syncing already upserts the catalogue. - Reading the waitlist is deleted. Every address on it belongs to someone who has not agreed to anything, and answering it over HTTP made that list something a leaked key could drain. - The pairing-code routes are deleted with the flow they served. The domain module and its table stay, so returning to it is a route file rather than a migration. Nothing in the API now accepts a credential that stands for more than one caller: every request resolves to a specific user or a specific host, which is what lets a route say "the caller's own library" and mean it. BREAKING CHANGE: the `x-nestri-admin-token` header is no longer accepted and `ADMIN_SHARED_SECRET` is no longer read. `POST /games`, `GET /waitlist` and the `/pairing-code` routes are gone; `POST /games/sync` and `POST /library/sync` now require host credentials and take `userId` in the body; `POST /steam/link` no longer accepts `userId`; `POST /games/download-state` no longer accepts `hostId`.
62 lines
1.8 KiB
TypeScript
62 lines
1.8 KiB
TypeScript
import { Examples } from '@nestri/core/examples';
|
|
import { Waitlist } from '@nestri/core/waitlist/index';
|
|
import { Hono } from 'hono';
|
|
import { describeRoute } from 'hono-openapi';
|
|
import { z } from 'zod';
|
|
|
|
import { ErrorResponses, Result, validator } from '../utils';
|
|
|
|
/**
|
|
* Public signups for not-yet-launched features (the machines waitlist).
|
|
*
|
|
* Deliberately unauthenticated: a visitor without an account should be able
|
|
* to leave an email. There is no route that reads the list back — every
|
|
* address on it belongs to someone who has not agreed to anything yet, so it
|
|
* is answered from the database by whoever is sending the announcement rather
|
|
* than exposed as a response a scraper could mine.
|
|
*/
|
|
export namespace WaitlistApi {
|
|
export const route = new Hono().post(
|
|
'/',
|
|
describeRoute({
|
|
tags: ['Waitlist'],
|
|
summary: 'Join the waitlist',
|
|
description: 'Leave an email to be notified when a feature launches. Public.',
|
|
responses: {
|
|
201: {
|
|
content: {
|
|
'application/json': {
|
|
schema: Result(
|
|
Waitlist.Info.meta({
|
|
description: 'The waitlist entry (the existing one if already joined)',
|
|
example: Examples.WaitlistEntry
|
|
})
|
|
)
|
|
}
|
|
},
|
|
description: 'Joined the waitlist'
|
|
},
|
|
400: ErrorResponses[400]
|
|
}
|
|
}),
|
|
validator(
|
|
'json',
|
|
z.object({
|
|
email: z.email().meta({
|
|
description: 'The email to notify',
|
|
example: Examples.WaitlistEntry.email
|
|
}),
|
|
source: z.string().default('machines').meta({
|
|
description: 'What the signup is for',
|
|
example: Examples.WaitlistEntry.source
|
|
})
|
|
})
|
|
),
|
|
async (c) => {
|
|
const { email, source } = c.req.valid('json');
|
|
const entry = await Waitlist.join({ email, source });
|
|
return c.json({ data: entry }, 201);
|
|
}
|
|
);
|
|
}
|