commit d80dd0fd807562b31b64e68b2aad8c6626f86e5f · bretton.dev/coves

+32 -4
internal/api/handlers/community/block.go
···

       6
       6
        
       	"encoding/json"

     

       7
       7
        
       	"log"

     

       8
       8
        
       	"net/http"

     

       9
       9
       +
       	"regexp"

     

       9
       10
        
       	"strings"

     

       10
       11
        
       )

     

       11
       12
        
       

     
···

       45
       46
        
       		return

     

       46
       47
        
       	}

     

       47
       48
        
       

     

       48
       48
       -
       	// Validate format (DID or handle)

     

       49
       49
       -
       	if !strings.HasPrefix(req.Community, "did:") && !strings.HasPrefix(req.Community, "!") {

     

       49
       49
       +
       	// Validate format (DID or handle) with proper regex patterns

     

       50
       50
       +
       	if strings.HasPrefix(req.Community, "did:") {

     

       51
       51
       +
       		// Validate DID format: did:method:identifier

     

       52
       52
       +
       		// atProto supports did:plc and did:web

     

       53
       53
       +
       		didRegex := regexp.MustCompile(`^did:(plc|web):[a-zA-Z0-9._:%-]+$`)

     

       54
       54
       +
       		if !didRegex.MatchString(req.Community) {

     

       55
       55
       +
       			writeError(w, http.StatusBadRequest, "InvalidRequest", "invalid DID format")

     

       56
       56
       +
       			return

     

       57
       57
       +
       		}

     

       58
       58
       +
       	} else if strings.HasPrefix(req.Community, "!") {

     

       59
       59
       +
       		// Validate handle format: !name@domain.tld

     

       60
       60
       +
       		if !strings.Contains(req.Community, "@") {

     

       61
       61
       +
       			writeError(w, http.StatusBadRequest, "InvalidRequest", "handle must contain @domain")

     

       62
       62
       +
       			return

     

       63
       63
       +
       		}

     

       64
       64
       +
       	} else {

     

       50
       65
        
       		writeError(w, http.StatusBadRequest, "InvalidRequest",

     

       51
       66
        
       			"community must be a DID (did:plc:...) or handle (!name@instance.com)")

     

       52
       67
        
       		return

     
···

       111
       126
        
       		return

     

       112
       127
        
       	}

     

       113
       128
        
       

     

       114
       114
       -
       	// Validate format (DID or handle)

     

       115
       115
       -
       	if !strings.HasPrefix(req.Community, "did:") && !strings.HasPrefix(req.Community, "!") {

     

       129
       129
       +
       	// Validate format (DID or handle) with proper regex patterns

     

       130
       130
       +
       	if strings.HasPrefix(req.Community, "did:") {

     

       131
       131
       +
       		// Validate DID format: did:method:identifier

     

       132
       132
       +
       		didRegex := regexp.MustCompile(`^did:(plc|web):[a-zA-Z0-9._:%-]+$`)

     

       133
       133
       +
       		if !didRegex.MatchString(req.Community) {

     

       134
       134
       +
       			writeError(w, http.StatusBadRequest, "InvalidRequest", "invalid DID format")

     

       135
       135
       +
       			return

     

       136
       136
       +
       		}

     

       137
       137
       +
       	} else if strings.HasPrefix(req.Community, "!") {

     

       138
       138
       +
       		// Validate handle format: !name@domain.tld

     

       139
       139
       +
       		if !strings.Contains(req.Community, "@") {

     

       140
       140
       +
       			writeError(w, http.StatusBadRequest, "InvalidRequest", "handle must contain @domain")

     

       141
       141
       +
       			return

     

       142
       142
       +
       		}

     

       143
       143
       +
       	} else {

     

       116
       144
        
       		writeError(w, http.StatusBadRequest, "InvalidRequest",

     

       117
       145
        
       			"community must be a DID (did:plc:...) or handle (!name@instance.com)")

     

       118
       146
        
       		return