mirror of
https://github.com/nestriness/nestri.git
synced 2026-09-19 17:25:19 +03:00
40b4270161
A single secret that turned any request into an operator was the only credential several routes accepted, and it had no caller left: the device pairing it existed for is on hold, and nothing in this tree or any client sent it. What remained was a key that bypassed authentication entirely, required to boot, and checked by nobody. Every route behind it had a better answer available: - Library and game sync move to host credentials. Both took a `userId` in the body, which meant one secret could write into anybody's library. A host now says which of its enrolled users a batch is for, and that claim is checked against the Steam sign-ins it actually holds — one box carries several people's accounts, so the pair is the unit. - Download-state reporting narrows to hosts alone, and the body that could name a different host is gone. Which host is reporting comes from its own credentials, and a body that still names one is refused rather than ignored. - Linking a Steam account is always for the caller. - Creating a game by hand is deleted; syncing already upserts the catalogue. - Reading the waitlist is deleted. Every address on it belongs to someone who has not agreed to anything, and answering it over HTTP made that list something a leaked key could drain. - The pairing-code routes are deleted with the flow they served. The domain module and its table stay, so returning to it is a route file rather than a migration. Nothing in the API now accepts a credential that stands for more than one caller: every request resolves to a specific user or a specific host, which is what lets a route say "the caller's own library" and mean it. BREAKING CHANGE: the `x-nestri-admin-token` header is no longer accepted and `ADMIN_SHARED_SECRET` is no longer read. `POST /games`, `GET /waitlist` and the `/pairing-code` routes are gone; `POST /games/sync` and `POST /library/sync` now require host credentials and take `userId` in the body; `POST /steam/link` no longer accepts `userId`; `POST /games/download-state` no longer accepts `hostId`.
33 lines
1.2 KiB
TypeScript
33 lines
1.2 KiB
TypeScript
import { Actor } from '@nestri/core/actor';
|
|
import { ErrorCodes, VisibleError } from '@nestri/core/error';
|
|
import { Enrolment } from '@nestri/core/steam/enrolment';
|
|
|
|
/**
|
|
* The user a host is allowed to speak about, or a refusal.
|
|
*
|
|
* One box carries several people's Steam sign-ins, so which user a batch
|
|
* belongs to has to be said rather than inferred from the credentials — and
|
|
* then checked, because a body field naming a user is otherwise a way to write
|
|
* into any library. The enrolment record is what it is checked against:
|
|
* holding a refresh token is what lets a host enumerate those games at all, so
|
|
* a host without one is reporting something it could not have observed.
|
|
*
|
|
* Shared by the two sync routes deliberately. The check is the whole boundary
|
|
* between "a host reporting what it can see" and "a host writing wherever it
|
|
* likes", and two copies of it are two things to keep in agreement.
|
|
*/
|
|
export async function enrolledUser(userId: string): Promise<string> {
|
|
const enrolment = await Enrolment.findByMachineAndUser({
|
|
machineId: Actor.machineID,
|
|
userId
|
|
});
|
|
if (!enrolment) {
|
|
throw new VisibleError(
|
|
'forbidden',
|
|
ErrorCodes.Permission.FORBIDDEN,
|
|
'This host holds no Steam sign-in for that user'
|
|
);
|
|
}
|
|
return userId;
|
|
}
|