🪻 distributed transcription service thistle.dunkirk.sh

feat: add missing input validation on admin endpoints

dunkirk.sh b92b7cf9 e679c97d

verified
Changed files
+53
src
+43
src/index.ts
···
getClassById,
getClassesForUser,
getClassMembers,
+
getMeetingById,
getMeetingTimesForClass,
getTranscriptionsForClass,
isUserEnrolledInClass,
···
requireAdmin(req);
const classId = req.params.id;
+
// Verify class exists
+
const existingClass = getClassById(classId);
+
if (!existingClass) {
+
return Response.json({ error: "Class not found" }, { status: 404 });
+
}
+
deleteClass(classId);
return Response.json({ success: true });
} catch (error) {
···
);
+
// Verify class exists
+
const existingClass = getClassById(classId);
+
if (!existingClass) {
+
return Response.json({ error: "Class not found" }, { status: 404 });
+
}
+
toggleClassArchive(classId, archived);
return Response.json({ success: true });
} catch (error) {
···
return Response.json({ error: "Email required" }, { status: 400 });
+
// Verify class exists
+
const existingClass = getClassById(classId);
+
if (!existingClass) {
+
return Response.json({ error: "Class not found" }, { status: 404 });
+
}
+
const user = getUserByEmail(email);
if (!user) {
return Response.json({ error: "User not found" }, { status: 404 });
···
return Response.json({ error: "Invalid user ID" }, { status: 400 });
+
// Verify class exists
+
const existingClass = getClassById(classId);
+
if (!existingClass) {
+
return Response.json({ error: "Class not found" }, { status: 404 });
+
}
+
removeUserFromClass(userId, classId);
return Response.json({ success: true });
} catch (error) {
···
return Response.json({ error: "Label required" }, { status: 400 });
+
// Verify class exists
+
const existingClass = getClassById(classId);
+
if (!existingClass) {
+
return Response.json({ error: "Class not found" }, { status: 404 });
+
}
+
const meetingTime = createMeetingTime(classId, label);
return Response.json(meetingTime);
} catch (error) {
···
return Response.json({ error: "Label required" }, { status: 400 });
+
// Verify meeting exists
+
const existingMeeting = getMeetingById(meetingId);
+
if (!existingMeeting) {
+
return Response.json({ error: "Meeting not found" }, { status: 404 });
+
}
+
updateMeetingTime(meetingId, label);
return Response.json({ success: true });
} catch (error) {
···
try {
requireAdmin(req);
const meetingId = req.params.id;
+
+
// Verify meeting exists
+
const existingMeeting = getMeetingById(meetingId);
+
if (!existingMeeting) {
+
return Response.json({ error: "Meeting not found" }, { status: 404 });
+
}
deleteMeetingTime(meetingId);
return Response.json({ success: true });
+10
src/lib/classes.ts
···
}
/**
+
* Get a single meeting time by ID
+
*/
+
export function getMeetingById(meetingId: string): MeetingTime | null {
+
const result = db
+
.query<MeetingTime, [string]>("SELECT * FROM meeting_times WHERE id = ?")
+
.get(meetingId);
+
return result ?? null;
+
}
+
+
/**
* Update a meeting time label
*/
export function updateMeetingTime(meetingId: string, label: string): void {