mirror of
https://github.com/hanzo-apps/dataroom.git
synced 2026-11-02 22:04:20 +00:00
zeekayandHanzo Dev
2c295299ae
@vercel/edge-config read NOTHING in production. EDGE_CONFIG is unset on this deployment, so every `get()` threw, and every call site caught it and fell back to an empty default. Several of them additionally checked `process.env. EDGE_CONFIG` and returned early, so the fallback was not even a fallback — it was the only path. What that meant, live: emails / keywords the blacklist matched nothing — abuse filtering was off trustedTeams no team was ever trusted betaFeatures no beta feature was ever on customEmail no team ever got its own sender address lib/config.ts reads these from Hanzo KV under a `config:` prefix, so a value changes with a KV write rather than a deploy — which is the reason the app reached for an edge config service to begin with. Reads never throw: a KV outage returns the caller's fallback, exactly as these call sites already assumed, so config can never take down a request path. customEmail is a Record, not a list, and now says so — it was being read through the list helper, which would have discarded it. @vercel/functions and @vercel/edge-config have no importers left and are dropped from package.json; the lockfile is regenerated and `npm ci --dry-run` is clean. @vercel/blob still has 10 importers and stays until storage moves to S3. Verified with npx tsc --noEmit: 100 errors before and after. Co-authored-by: Hanzo Dev <[email protected]>
133 lines
3.7 KiB
TypeScript
133 lines
3.7 KiB
TypeScript
import { NextApiRequest, NextApiResponse } from "next";
|
|
|
|
import { authOptions } from "@/pages/api/auth/[...nextauth]";
|
|
import { getStringList } from "@/lib/config";
|
|
import { getServerSession } from "next-auth/next";
|
|
|
|
import { isTrustedTeam } from "@/lib/edge-config/trusted-teams";
|
|
import prisma from "@/lib/prisma";
|
|
import { CustomUser } from "@/lib/types";
|
|
import { log } from "@/lib/utils";
|
|
import { linkUrlUpdateSchema } from "@/lib/zod/url-validation";
|
|
|
|
export default async function handle(
|
|
req: NextApiRequest,
|
|
res: NextApiResponse,
|
|
) {
|
|
if (req.method !== "PATCH") {
|
|
return res.status(405).json({ message: "Method not allowed" });
|
|
}
|
|
|
|
const session = await getServerSession(req, res, authOptions);
|
|
if (!session) {
|
|
return res.status(401).json({ message: "Unauthorized" });
|
|
}
|
|
|
|
const userId = (session.user as CustomUser).id;
|
|
const { teamId, id: documentId } = req.query as {
|
|
teamId: string;
|
|
id: string;
|
|
};
|
|
const { linkUrl } = req.body as { linkUrl: string };
|
|
|
|
const validationResult = await linkUrlUpdateSchema.safeParseAsync(linkUrl);
|
|
if (!validationResult.success) {
|
|
return res.status(400).json({ message: validationResult.error.message });
|
|
}
|
|
|
|
const validatedUrl = validationResult.data;
|
|
|
|
try {
|
|
const teamAccess = await prisma.userTeam.findUnique({
|
|
where: {
|
|
userId_teamId: {
|
|
userId: userId,
|
|
teamId: teamId,
|
|
},
|
|
},
|
|
});
|
|
if (!teamAccess) {
|
|
return res.status(401).json({ message: "Unauthorized" });
|
|
}
|
|
|
|
// Check if document exists
|
|
const document = await prisma.document.findUnique({
|
|
where: {
|
|
id: documentId,
|
|
teamId: teamId,
|
|
},
|
|
select: {
|
|
id: true,
|
|
file: true,
|
|
type: true,
|
|
versions: {
|
|
select: { id: true, file: true, type: true },
|
|
orderBy: { createdAt: "desc" },
|
|
take: 1,
|
|
},
|
|
},
|
|
});
|
|
|
|
if (!document) {
|
|
return res.status(404).json({ message: "Document not found" });
|
|
}
|
|
|
|
if (document.type !== "link") {
|
|
return res
|
|
.status(400)
|
|
.json({ message: "Document is not a link document" });
|
|
}
|
|
|
|
if (!document.versions[0]) {
|
|
return res.status(400).json({ message: "Document has no versions" });
|
|
}
|
|
|
|
// Check if URL contains blocked keywords (skip for trusted teams)
|
|
const trusted = await isTrustedTeam(teamId);
|
|
if (!trusted) {
|
|
const keywords = await getStringList("keywords");
|
|
if (Array.isArray(keywords) && keywords.length > 0) {
|
|
const matchedKeyword = keywords.find(
|
|
(keyword) =>
|
|
typeof keyword === "string" &&
|
|
validatedUrl.toLowerCase().includes(keyword.toLowerCase()),
|
|
);
|
|
|
|
if (matchedKeyword) {
|
|
log({
|
|
message: `Link URL update blocked: ${matchedKeyword} \n\n \`Metadata: {teamId: ${teamId}, documentId: ${documentId}, url: ${validatedUrl}}\``,
|
|
type: "error",
|
|
mention: true,
|
|
});
|
|
return res.status(400).json({
|
|
message: "This URL is not allowed",
|
|
matchedKeyword: matchedKeyword,
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
// Update document version
|
|
await prisma.document.update({
|
|
where: {
|
|
id: documentId,
|
|
teamId: teamId,
|
|
},
|
|
data: {
|
|
file: validatedUrl.toString(),
|
|
versions: {
|
|
update: {
|
|
where: { id: document.versions[0].id },
|
|
data: { file: validatedUrl.toString() },
|
|
},
|
|
},
|
|
},
|
|
});
|
|
|
|
return res.status(200).json({ message: "Link URL updated successfully" });
|
|
} catch (error) {
|
|
console.error("Error updating Link URL:", error);
|
|
return res.status(500).json({ message: "Internal server error" });
|
|
}
|
|
}
|