Security/apis

components/docs/modals.tsx

@@ -12,7 +12,6 @@ import {
   IconGif,
   IconVideo,
   IconUpload,
-  IconFolder,
 } from "@tabler/icons-react";
 import { docsPanelShadow } from "./shell";
 import {

lib/security.ts

@@ -0,0 +1,38 @@
+import type {
+  NextApiHandler,
+  NextApiRequest,
+  NextApiResponse
+} from "next";
+
+export function verifyWorkspace(req: NextApiRequest): boolean {
+  const { id: workspaceId } = req.query;
+  if (!workspaceId) return true;
+
+  const workspace = Array.isArray(workspaceId) ? workspaceId[0] : workspaceId;
+
+  const isValidWorkspaceId = /^[A-Za-z0-9_-]+$/.test(workspace);
+  if (!isValidWorkspaceId) return false;
+  return true
+}
+
+export function withHandler(
+  handler: (req: NextApiRequest, res: NextApiResponse) => any,
+): NextApiHandler {
+  return async (req: NextApiRequest, res: NextApiResponse) => {
+    try {
+      if (!verifyWorkspace(req)) return res.status(400).send({
+        success: false,
+        error: "Not valid workspace"
+      });
+
+      return handler(req, res);
+    } catch (error) {
+      console.error("Handler error:", error);
+
+      return res.status(500).json({
+        success: false,
+        error: "Internal Server Error",
+      });
+    }
+  };
+}

lib/withAuth.ts

@@ -12,6 +12,7 @@ import * as cookie from "cookie";
 import * as crypto from "crypto";
 import { getConfig } from "@/utils/configEngine";
 import prisma from "@/utils/database";
+import { verifyWorkspace } from "./security";
 
 if (process.env.NODE_ENV === "production") {
   const secret =
@@ -56,6 +57,10 @@ export function withAuth(
   handler: (req: AuthenticatedRequest, res: NextApiResponse) => any,
 ): NextApiHandler {
   return async (req: NextApiRequest, res: NextApiResponse) => {
+    if (!verifyWorkspace(req)) return res.status(400).send({
+      success: false,
+      error: "Not valid workspace"
+    });
     try {
       const cookies = cookie.parse(req.headers.cookie || "");
 
@@ -115,6 +120,10 @@ export function withKey(
   handler: (req: NextApiRequest, res: NextApiResponse) => any,
 ): NextApiHandler {
   return async (req: NextApiRequest, res: NextApiResponse) => {
+    if (!verifyWorkspace(req)) return res.status(400).send({
+      success: false,
+      error: "Not valid workspace"
+    })
     const { id } = req.query;
     try {
       const auth = req.headers.authorization;

pages/api/setup/opencloudtest.ts

@@ -1,6 +1,6 @@
 import { NextApiResponse } from "next";
 import axios from "axios";
-import { AuthenticatedRequest, withAuth } from "@/lib/withAuth";
+import { AuthenticatedRequest } from "@/lib/withAuth";
 
 interface OpenCloudKeyRes {
   name: string;

pages/api/user/firstLogin.ts

@@ -1,5 +1,5 @@
 // Next.js API route support: https://nextjs.org/docs/api-routes/introduction
-import type { NextApiRequest, NextApiResponse } from 'next'
+import type { NextApiResponse } from 'next'
 import prisma from '@/utils/database';
 import { AuthenticatedRequest, withAuth } from '@/lib/withAuth';
 

pages/api/workspace/[id]/activity/history/[userId].ts

@@ -1,6 +1,5 @@
-import { withPermissionCheck } from "@/utils/permissionsManager";
 import { AuthenticatedRequest, withAuth } from "@/lib/withAuth";
-import type { NextApiRequest, NextApiResponse } from "next";
+import type { NextApiResponse } from "next";
 import prisma from "@/utils/database";
 
 export default withAuth(async function handler(

pages/api/workspace/[id]/allies/[aid]/delete.ts

@@ -1,11 +1,7 @@
 // Next.js API route support: https://nextjs.org/docs/api-routes/introduction
-import type { NextApiRequest, NextApiResponse } from 'next'
-import { fetchworkspace, getConfig, setConfig } from '@/utils/configEngine'
-import prisma, { inactivityNotice } from '@/utils/database';
-// import { withAuth } from '@/lib/withSession'
+import type { NextApiResponse } from 'next'
+import prisma from '@/utils/database';
 import { withPermissionCheck } from '@/utils/permissionsManager'
-import { getUsername, getThumbnail, getDisplayName } from '@/utils/userinfoEngine'
-import * as noblox from 'noblox.js'
 import { AuthenticatedRequest } from '@/lib/withAuth';
 type Data = {
 	success: boolean

pages/api/workspace/[id]/allies/[aid]/discipline.ts

@@ -1,4 +1,4 @@
-import type { NextApiRequest, NextApiResponse } from "next";
+import type { NextApiResponse } from "next";
 import { AuthenticatedRequest, withAuth } from "@/lib/withAuth";
 import prisma from "@/utils/database";
 import { getConfig } from "@/utils/configEngine";

pages/api/workspace/[id]/allies/[aid]/notes.ts

@@ -1,5 +1,5 @@
 // Next.js API route support: https://nextjs.org/docs/api-routes/introduction
-import type { NextApiRequest, NextApiResponse } from 'next'
+import type { NextApiResponse } from 'next'
 import prisma from '@/utils/database';
 import { AuthenticatedRequest, withAuth } from '@/lib/withAuth';
 

pages/api/workspace/[id]/allies/[aid]/reps.ts

@@ -1,11 +1,7 @@
 // Next.js API route support: https://nextjs.org/docs/api-routes/introduction
-import type { NextApiRequest, NextApiResponse } from 'next'
-import { fetchworkspace, getConfig, setConfig } from '@/utils/configEngine'
-import prisma, { inactivityNotice } from '@/utils/database';
-// import { withAuth } from '@/lib/withSession'
+import type { NextApiResponse } from 'next'
+import prisma from '@/utils/database';
 import { withPermissionCheck } from '@/utils/permissionsManager'
-import { getUsername, getThumbnail, getDisplayName } from '@/utils/userinfoEngine'
-import * as noblox from 'noblox.js'
 import { AuthenticatedRequest } from '@/lib/withAuth';
 type Data = {
 	success: boolean

pages/api/workspace/[id]/allies/[aid]/update.ts

@@ -1,4 +1,4 @@
-import type { NextApiRequest, NextApiResponse } from 'next';
+import type { NextApiResponse } from 'next';
 import prisma from '@/utils/database';
 import { AuthenticatedRequest, withAuth } from '@/lib/withAuth';
 

pages/api/workspace/[id]/allies/[aid]/visits/[vid].ts

@@ -1,10 +1,6 @@
 // Next.js API route support: https://nextjs.org/docs/api-routes/introduction
-import type { NextApiRequest, NextApiResponse } from 'next'
-import { fetchworkspace, getConfig, setConfig } from '@/utils/configEngine'
-import prisma, { allyVisit } from '@/utils/database';
-import { withPermissionCheck } from '@/utils/permissionsManager'
-import { getUsername, getThumbnail, getDisplayName } from '@/utils/userinfoEngine'
-import * as noblox from 'noblox.js'
+import type { NextApiResponse } from 'next'
+import prisma from '@/utils/database';
 import { AuthenticatedRequest, withAuth } from '@/lib/withAuth';
 type Data = {
 	success: boolean

pages/api/workspace/[id]/allies/[aid]/visits/index.ts

@@ -1,8 +1,7 @@
 // Next.js API route support: https://nextjs.org/docs/api-routes/introduction
-import type { NextApiRequest, NextApiResponse } from 'next'
+import type { NextApiResponse } from 'next'
 import prisma from '@/utils/database';
 import { AuthenticatedRequest, withAuth } from '@/lib/withAuth';
-// import { withAuth } from '@/lib/withSession'
 
 type Data = {
 	success: boolean

pages/api/workspace/[id]/allies/new.ts

@@ -1,8 +1,7 @@
 // Next.js API route support: https://nextjs.org/docs/api-routes/introduction
-import type { NextApiRequest, NextApiResponse } from 'next'
+import type { NextApiResponse } from 'next'
 import prisma from '@/utils/database';
 import { withPermissionCheck } from '@/utils/permissionsManager'
-import moment from 'moment';
 import * as noblox from 'noblox.js'
 import { AuthenticatedRequest } from '@/lib/withAuth';
 type Data = {

pages/api/workspace/[id]/announcement/update.ts

@@ -1,4 +1,4 @@
-import type { NextApiRequest, NextApiResponse } from "next";
+import type { NextApiResponse } from "next";
 import prisma from "@/utils/database";
 import { withPermissionCheck } from "@/utils/permissionsManager";
 import { logAudit } from "@/utils/logs";

pages/api/workspace/[id]/api-keys/[keyId]/create.ts

@@ -1,4 +1,4 @@
-import type { NextApiRequest, NextApiResponse } from "next"
+import type { NextApiResponse } from "next"
 import { withPermissionCheck } from "@/utils/permissionsManager"
 import prisma from "@/utils/database"
 import crypto from "crypto"

pages/api/workspace/[id]/api-keys/[keyId]/delete.ts

@@ -1,4 +1,4 @@
-import type { NextApiRequest, NextApiResponse } from "next"
+import type { NextApiResponse } from "next"
 import { withPermissionCheck } from "@/utils/permissionsManager"
 import prisma from "@/utils/database"
 import { AuthenticatedRequest } from "@/lib/withAuth"

pages/api/workspace/[id]/birthday/[userId].ts

@@ -1,4 +1,4 @@
-import type { NextApiRequest, NextApiResponse } from 'next';
+import type { NextApiResponse } from 'next';
 import prisma from '@/utils/database';
 import { AuthenticatedRequest, withAuth } from '@/lib/withAuth';
 

pages/api/workspace/[id]/guides/[docid]/delete.ts

@@ -1,11 +1,8 @@
 // Next.js API route support: https://nextjs.org/docs/api-routes/introduction
-import type { NextApiRequest, NextApiResponse } from 'next'
-import { fetchworkspace, getConfig, setConfig } from '@/utils/configEngine'
+import type { NextApiResponse } from 'next'
 import prisma from '@/utils/database';
 import { withPermissionCheck } from '@/utils/permissionsManager'
 import { logAudit } from '@/utils/logs'
-import { getUsername, getThumbnail, getDisplayName } from '@/utils/userinfoEngine'
-import * as noblox from 'noblox.js'
 import { AuthenticatedRequest } from '@/lib/withAuth';
 type Data = {
 	success: boolean

pages/api/workspace/[id]/home/activeSessions.ts

@@ -1,12 +1,7 @@
 // Next.js API route support: https://nextjs.org/docs/api-routes/introduction
 import type { NextApiRequest, NextApiResponse } from 'next'
-import { fetchworkspace, getConfig, setConfig } from '@/utils/configEngine'
-import prisma, { SessionType, Session } from '@/utils/database';
-// import { withAuth } from '@/lib/withSession'
+import prisma, { Session } from '@/utils/database';
 import { withPermissionCheck } from '@/utils/permissionsManager'
-
-import { getUsername, getThumbnail, getDisplayName } from '@/utils/userinfoEngine'
-import * as noblox from 'noblox.js'
 type Data = {
 	success: boolean
 	error?: string

pages/api/workspace/[id]/home/docs.ts

@@ -1,4 +1,4 @@
-import type { NextApiRequest, NextApiResponse } from "next";
+import type { NextApiResponse } from "next";
 import prisma, { document } from "@/utils/database";
 import { withPermissionCheck } from "@/utils/permissionsManager";
 import { AuthenticatedRequest } from "@/lib/withAuth";

pages/api/workspace/[id]/home/new-members.ts

@@ -1,4 +1,4 @@
-import type { NextApiRequest, NextApiResponse } from 'next';
+import type { NextApiResponse } from 'next';
 import prisma from '@/utils/database';
 import { AuthenticatedRequest, withAuth } from '@/lib/withAuth';
 

pages/api/workspace/[id]/home/quickLinks.ts

@@ -1,5 +1,4 @@
 import type { NextApiRequest, NextApiResponse } from 'next'
-import prisma, { document } from '@/utils/database';
 import { withPermissionCheck } from '@/utils/permissionsManager'
 import axios from 'axios';
 import PackageInfo from '@/package.json'

pages/api/workspace/[id]/home/upcoming.ts

@@ -1,4 +1,4 @@
-import type { NextApiRequest, NextApiResponse } from "next";
+import type { NextApiResponse } from "next";
 import prisma from "@/utils/database";
 import { AuthenticatedRequest, withAuth } from "@/lib/withAuth";
 

pages/api/workspace/[id]/home/wall.ts

@@ -1,12 +1,6 @@
-// Next.js API route support: https://nextjs.org/docs/api-routes/introduction
 import type { NextApiRequest, NextApiResponse } from 'next'
-import { fetchworkspace, getConfig, setConfig } from '@/utils/configEngine'
-import prisma, { SessionType, Session, wallPost } from '@/utils/database';
-// import { withAuth } from '@/lib/withSession'
+import prisma, { wallPost } from '@/utils/database';
 import { withPermissionCheck } from '@/utils/permissionsManager'
-
-import { getUsername, getThumbnail, getDisplayName } from '@/utils/userinfoEngine'
-import * as noblox from 'noblox.js'
 type Data = {
 	success: boolean
 	error?: string

pages/api/workspace/[id]/policies/[docId].ts

@@ -1,7 +1,6 @@
-import type { NextApiRequest, NextApiResponse } from 'next'
+import type { NextApiResponse } from 'next'
 import prisma from '@/utils/database';
 import { logAudit } from '@/utils/logs';
-// import { withAuth } from '@/lib/withSession'
 import { withPermissionCheck } from '@/utils/permissionsManager'
 import { AuthenticatedRequest } from '@/lib/withAuth';
 

pages/api/workspace/[id]/policies/create.ts

@@ -3,7 +3,6 @@ import { fetchworkspace, getConfig, setConfig } from '@/utils/configEngine'
 import prisma, { SessionType, document } from '@/utils/database';
 import { logAudit } from '@/utils/logs';
 import { sanitizeJSON } from '@/utils/sanitise';
-// import { withAuth } from '@/lib/withSession'
 import { withPermissionCheck } from '@/utils/permissionsManager'
 
 import { getUsername, getThumbnail, getDisplayName } from '@/utils/userinfoEngine'

pages/api/workspace/[id]/policies/pending.ts

@@ -1,5 +1,5 @@
 import { withPermissionCheck } from "@/utils/permissionsManager";
-import type { NextApiRequest, NextApiResponse } from "next";
+import type { NextApiResponse } from "next";
 import prisma from "@/utils/database";
 import { AuthenticatedRequest } from "@/lib/withAuth";
 

pages/api/workspace/[id]/resignations/count.ts

@@ -1,4 +1,4 @@
-import type { NextApiRequest, NextApiResponse } from "next";
+import type { NextApiResponse } from "next";
 import prisma from "@/utils/database";
 import { withPermissionCheck } from "@/utils/permissionsManager";
 import { AuthenticatedRequest } from "@/lib/withAuth";

pages/api/workspace/[id]/resignations/create.ts

@@ -1,4 +1,4 @@
-import type { NextApiRequest, NextApiResponse } from "next";
+import type { NextApiResponse } from "next";
 import prisma from "@/utils/database";
 import { withPermissionCheck } from "@/utils/permissionsManager";
 import { AuthenticatedRequest } from "@/lib/withAuth";

pages/api/workspace/[id]/resignations/update.ts

@@ -1,4 +1,4 @@
-import type { NextApiRequest, NextApiResponse } from "next";
+import type { NextApiResponse } from "next";
 import prisma from "@/utils/database";
 import { logAudit } from "@/utils/logs";
 import { withPermissionCheck } from "@/utils/permissionsManager";

pages/api/workspace/[id]/sessions/[sid]/notes/[noteId].ts

@@ -1,4 +1,4 @@
-import type { NextApiRequest, NextApiResponse } from "next";
+import type { NextApiResponse } from "next";
 import prisma from "@/utils/database";
 import { AuthenticatedRequest, withAuth } from "@/lib/withAuth";
 

pages/api/workspace/[id]/sessions/create-unscheduled.ts

@@ -1,4 +1,4 @@
-import type { NextApiRequest, NextApiResponse } from "next";
+import type { NextApiResponse } from "next";
 import prisma from "@/utils/database";
 import { AuthenticatedRequest, withAuth } from "@/lib/withAuth";
 

pages/api/workspace/[id]/sessions/manage/[sid]/claim.ts

@@ -1,7 +1,6 @@
 // Next.js API route support: https://nextjs.org/docs/api-routes/introduction
-import type { NextApiRequest, NextApiResponse } from "next";
+import type { NextApiResponse } from "next";
 import prisma, { schedule } from "@/utils/database";
-import roles from "../../../settings/roles";
 import { AuthenticatedRequest, withAuth } from "@/lib/withAuth";
 type Data = {
   success: boolean;
@@ -21,7 +20,7 @@ export async function handler(req: AuthenticatedRequest, res: NextApiResponse<Da
     return res
       .status(400)
       .json({ success: false, error: "Missing required fields" });
-  const { date, timezoneOffset } = req.body;
+  const { date } = req.body;
   if (!date)
     return res
       .status(400)

pages/api/workspace/[id]/sessions/manage/[sid]/claimSlot.ts

@@ -1,5 +1,5 @@
 // Next.js API route support: https://nextjs.org/docs/api-routes/introduction
-import type { NextApiRequest, NextApiResponse } from "next";
+import type { NextApiResponse } from "next";
 import prisma, { schedule } from "@/utils/database";
 import { AuthenticatedRequest, withAuth } from "@/lib/withAuth";
 
@@ -28,8 +28,6 @@ export async function handler(req: AuthenticatedRequest, res: NextApiResponse<Da
       .json({ success: false, error: "Missing required fields" });
   const day = new Date(date);
 
-  const days = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
-
   const user = await prisma.user.findUnique({
     where: {
       userid: BigInt(req.auth.userId),

pages/api/workspace/[id]/sessions/manage/[sid]/end.ts

@@ -1,5 +1,5 @@
 // Next.js API route support: https://nextjs.org/docs/api-routes/introduction
-import type { NextApiRequest, NextApiResponse } from "next";
+import type { NextApiResponse } from "next";
 import prisma from "@/utils/database";
 import { AuthenticatedRequest, withAuth } from "@/lib/withAuth";
 type Data = {

pages/api/workspace/[id]/sessions/manage/[sid]/unclaim.ts

@@ -1,5 +1,5 @@
 // Next.js API route support: https://nextjs.org/docs/api-routes/introduction
-import type { NextApiRequest, NextApiResponse } from "next";
+import type { NextApiResponse } from "next";
 import prisma, { schedule } from "@/utils/database";
 import { AuthenticatedRequest, withAuth } from "@/lib/withAuth";
 
@@ -21,7 +21,7 @@ export async function handler(req: AuthenticatedRequest, res: NextApiResponse<Da
     return res
       .status(400)
       .json({ success: false, error: "Missing required fields" });
-  const { date, timezoneOffset } = req.body;
+  const { date } = req.body;
   if (!date)
     return res
       .status(400)

pages/api/workspace/[id]/settings/api-keys/[keyId]/delete.ts

@@ -1,4 +1,4 @@
-import type { NextApiRequest, NextApiResponse } from "next"
+import type { NextApiResponse } from "next"
 import { withPermissionCheck } from "@/utils/permissionsManager"
 import prisma from "@/utils/database"
 import { AuthenticatedRequest } from "@/lib/withAuth"

pages/api/workspace/[id]/settings/api-keys/create.ts

@@ -1,4 +1,4 @@
-import type { NextApiRequest, NextApiResponse } from "next"
+import type {  NextApiResponse } from "next"
 import { withPermissionCheck } from "@/utils/permissionsManager"
 import prisma from "@/utils/database"
 import crypto from "crypto"

pages/api/workspace/[id]/settings/api-keys/index.ts

@@ -1,4 +1,4 @@
-import type { NextApiRequest, NextApiResponse } from "next"
+import type { NextApiResponse } from "next"
 import { withPermissionCheck } from "@/utils/permissionsManager"
 import prisma from "@/utils/database"
 import { AuthenticatedRequest } from "@/lib/withAuth"