Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
function AdminRequired() {
return Hook((ctx: Context) => {
if (!ctx.user.isAdmin) {
return new HttpResponseForbidden();
}
});
}
function AddXXXHeader() {
return Hook(ctx => response => {
response.setHeader('XXX', 'YYY');
});
}
function ValidateParamType() {
return Hook(function(this: any, ctx: Context) {
if (typeof ctx.request.params.id !== this.paramType) {
return new HttpResponseBadRequest();
}
});
}
export function TestFooBar(): HookDecorator {
return Hook(async (ctx, services) => {
});
}
function ValidateBody() {
return Hook(ctx => {
if (typeof ctx.request.body.name !== 'string') {
return new HttpResponseBadRequest();
}
});
}
function AdminRequired() {
return Hook((ctx: Context) => {
if (!ctx.user.isAdmin) {
return new HttpResponseForbidden();
}
});
}
export function ValidateBody(cls: Class, options: ValidateBodyOptions = {}): HookDecorator {
return Hook(async ctx => {
if (typeof ctx.request.body !== 'object' || ctx.request.body === null) {
return new HttpResponseBadRequest({
message: 'The request body should be a valid JSON object or array.'
});
}
const instance = plainToClass(cls, ctx.request.body, options.transformer);
const errors = await validate(instance, options.validator);
if (errors.length > 0) {
return new HttpResponseBadRequest(errors);
}
ctx.request.body = instance;
});
}
export function PermissionRequired(perm: string, options: { redirect?: string } = {}): HookDecorator {
return Hook(ctx => {
if (!ctx.user) {
if (options.redirect) {
return new HttpResponseRedirect(options.redirect);
}
return new HttpResponseUnauthorized();
}
if (!ctx.user.hasPerm(perm)) {
return new HttpResponseForbidden();
}
});
}
export function CsrfTokenRequired(options: { doubleSubmitCookie?: boolean } = {}): HookDecorator {
return Hook(async (ctx, services) => {
const config = services.get(Config);
if (!config.get('settings.csrf.enabled', true)) {
return;
}
let expectedToken: string;
if (options.doubleSubmitCookie) {
const secret = config.get('settings.csrf.secret');
if (!secret) {
throw new Error(
'[CONFIG] You must provide a secret with the configuration key settings.csrf.secret.'
);
}