commit 07dd273c3d5f06af814e8afb246c85eca198bda2 · dunkirk.sh/thistle

+63

src/index.ts

···

       893
        
       			POST: async (req) => {

     

       894
        
       				try {

     

       895
        
       					const user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       896
        
       					const options = await createRegistrationOptions(user);

     

       897
        
       					return Response.json(options);

     

       898
        
       				} catch (err) {

     
···

       904
        
       			POST: async (req) => {

     

       905
        
       				try {

     

       906
        
       					const _user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       907
        
       					const body = await req.json();

     

       908
        
       					const { response: credentialResponse, challenge, name } = body;

     

       909
        
       

     
···

       929
        
       		"/api/passkeys/authenticate/options": {

     

       930
        
       			POST: async (req) => {

     

       931
        
       				try {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       932
        
       					const body = await req.json();

     

       933
        
       					const { email } = body;

     

       934
        
       

     
···

       942
        
       		"/api/passkeys/authenticate/verify": {

     

       943
        
       			POST: async (req) => {

     

       944
        
       				try {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       945
        
       					const body = await req.json();

     

       946
        
       					const { response: credentialResponse, challenge } = body;

     

       947
        
       

     
···

       1007
        
       			PUT: async (req) => {

     

       1008
        
       				try {

     

       1009
        
       					const user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1010
        
       					const body = await req.json();

     

       1011
        
       					const { name } = body;

     

       1012
        
       					const passkeyId = req.params.id;

     
···

       1024
        
       			DELETE: async (req) => {

     

       1025
        
       				try {

     

       1026
        
       					const user = requireAuth(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1027
        
       					const passkeyId = req.params.id;

     

       1028
        
       					deletePasskey(passkeyId, user.id);

     

       1029
        
       					return Response.json({ success: true });

     
···

       1063
        
       				if (!user) {

     

       1064
        
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1065
        
       				}

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1066
        
       				const body = await req.json();

     

       1067
        
       				const targetSessionId = body.sessionId;

     

       1068
        
       				if (!targetSessionId) {

     
···

       1277
        
       				if (!user) {

     

       1278
        
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1279
        
       				}

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1280
        
       				const body = await req.json();

     

       1281
        
       				const { name } = body;

     

       1282
        
       				if (!name) {

     
···

       1303
        
       				if (!user) {

     

       1304
        
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1305
        
       				}

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1306
        
       				const body = await req.json();

     

       1307
        
       				const { avatar } = body;

     

       1308
        
       				if (!avatar) {

     
···

       1329
        
       				if (!user) {

     

       1330
        
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1331
        
       				}

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1332
        
       				const body = await req.json();

     

       1333
        
       				const { email_notifications_enabled } = body;

     

       1334
        
       				if (typeof email_notifications_enabled !== "boolean") {

     
···

       2015
        
       			POST: async (req) => {

     

       2016
        
       				try {

     

       2017
        
       					const user = requireSubscription(req);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2018
        
       

     

       2019
        
       					const formData = await req.formData();

     

       2020
        
       					const file = formData.get("audio") as File;

···

       893
        
       			POST: async (req) => {

     

       894
        
       				try {

     

       895
        
       					const user = requireAuth(req);

     

       896
       +
       

     

       897
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-register-options", {

     

       898
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       899
       +
       					});

     

       900
       +
       					if (rateLimitError) return rateLimitError;

     

       901
       +
       

     

       902
        
       					const options = await createRegistrationOptions(user);

     

       903
        
       					return Response.json(options);

     

       904
        
       				} catch (err) {

     
···

       910
        
       			POST: async (req) => {

     

       911
        
       				try {

     

       912
        
       					const _user = requireAuth(req);

     

       913
       +
       

     

       914
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-register-verify", {

     

       915
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       916
       +
       					});

     

       917
       +
       					if (rateLimitError) return rateLimitError;

     

       918
       +
       

     

       919
        
       					const body = await req.json();

     

       920
        
       					const { response: credentialResponse, challenge, name } = body;

     

       921
        
       

     
···

       941
        
       		"/api/passkeys/authenticate/options": {

     

       942
        
       			POST: async (req) => {

     

       943
        
       				try {

     

       944
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-auth-options", {

     

       945
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       946
       +
       					});

     

       947
       +
       					if (rateLimitError) return rateLimitError;

     

       948
       +
       

     

       949
        
       					const body = await req.json();

     

       950
        
       					const { email } = body;

     

       951
        
       

     
···

       959
        
       		"/api/passkeys/authenticate/verify": {

     

       960
        
       			POST: async (req) => {

     

       961
        
       				try {

     

       962
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-auth-verify", {

     

       963
       +
       						ip: { max: 10, windowSeconds: 5 * 60 },

     

       964
       +
       					});

     

       965
       +
       					if (rateLimitError) return rateLimitError;

     

       966
       +
       

     

       967
        
       					const body = await req.json();

     

       968
        
       					const { response: credentialResponse, challenge } = body;

     

       969
        
       

     
···

       1029
        
       			PUT: async (req) => {

     

       1030
        
       				try {

     

       1031
        
       					const user = requireAuth(req);

     

       1032
       +
       

     

       1033
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-update", {

     

       1034
       +
       						ip: { max: 10, windowSeconds: 60 * 60 },

     

       1035
       +
       					});

     

       1036
       +
       					if (rateLimitError) return rateLimitError;

     

       1037
       +
       

     

       1038
        
       					const body = await req.json();

     

       1039
        
       					const { name } = body;

     

       1040
        
       					const passkeyId = req.params.id;

     
···

       1052
        
       			DELETE: async (req) => {

     

       1053
        
       				try {

     

       1054
        
       					const user = requireAuth(req);

     

       1055
       +
       

     

       1056
       +
       					const rateLimitError = enforceRateLimit(req, "passkey-delete", {

     

       1057
       +
       						ip: { max: 10, windowSeconds: 60 * 60 },

     

       1058
       +
       					});

     

       1059
       +
       					if (rateLimitError) return rateLimitError;

     

       1060
       +
       

     

       1061
        
       					const passkeyId = req.params.id;

     

       1062
        
       					deletePasskey(passkeyId, user.id);

     

       1063
        
       					return Response.json({ success: true });

     
···

       1097
        
       				if (!user) {

     

       1098
        
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1099
        
       				}

     

       1100
       +
       

     

       1101
       +
       				const rateLimitError = enforceRateLimit(req, "delete-session", {

     

       1102
       +
       					ip: { max: 20, windowSeconds: 60 * 60 },

     

       1103
       +
       				});

     

       1104
       +
       				if (rateLimitError) return rateLimitError;

     

       1105
       +
       

     

       1106
        
       				const body = await req.json();

     

       1107
        
       				const targetSessionId = body.sessionId;

     

       1108
        
       				if (!targetSessionId) {

     
···

       1317
        
       				if (!user) {

     

       1318
        
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1319
        
       				}

     

       1320
       +
       

     

       1321
       +
       				const rateLimitError = enforceRateLimit(req, "update-name", {

     

       1322
       +
       					ip: { max: 10, windowSeconds: 5 * 60 },

     

       1323
       +
       				});

     

       1324
       +
       				if (rateLimitError) return rateLimitError;

     

       1325
       +
       

     

       1326
        
       				const body = await req.json();

     

       1327
        
       				const { name } = body;

     

       1328
        
       				if (!name) {

     
···

       1349
        
       				if (!user) {

     

       1350
        
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1351
        
       				}

     

       1352
       +
       

     

       1353
       +
       				const rateLimitError = enforceRateLimit(req, "update-avatar", {

     

       1354
       +
       					ip: { max: 10, windowSeconds: 5 * 60 },

     

       1355
       +
       				});

     

       1356
       +
       				if (rateLimitError) return rateLimitError;

     

       1357
       +
       

     

       1358
        
       				const body = await req.json();

     

       1359
        
       				const { avatar } = body;

     

       1360
        
       				if (!avatar) {

     
···

       1381
        
       				if (!user) {

     

       1382
        
       					return Response.json({ error: "Invalid session" }, { status: 401 });

     

       1383
        
       				}

     

       1384
       +
       

     

       1385
       +
       				const rateLimitError = enforceRateLimit(req, "update-notifications", {

     

       1386
       +
       					ip: { max: 10, windowSeconds: 5 * 60 },

     

       1387
       +
       				});

     

       1388
       +
       				if (rateLimitError) return rateLimitError;

     

       1389
       +
       

     

       1390
        
       				const body = await req.json();

     

       1391
        
       				const { email_notifications_enabled } = body;

     

       1392
        
       				if (typeof email_notifications_enabled !== "boolean") {

     
···

       2073
        
       			POST: async (req) => {

     

       2074
        
       				try {

     

       2075
        
       					const user = requireSubscription(req);

     

       2076
       +
       

     

       2077
       +
       					const rateLimitError = enforceRateLimit(req, "upload-transcription", {

     

       2078
       +
       						ip: { max: 20, windowSeconds: 60 * 60 },

     

       2079
       +
       					});

     

       2080
       +
       					if (rateLimitError) return rateLimitError;

     

       2081
        
       

     

       2082
        
       					const formData = await req.formData();

     

       2083
        
       					const file = formData.get("audio") as File;