Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
roomStream.on('join', function(roomId) {
check(roomId, String);
// eslint-disable-next-line no-console
console.log('join', roomId, this.userId);
const self = this;
// notify everyone in the room that the peer has connected
const room = Rooms.findOne({ _id: roomId });
// don't let connected users add connection in different browser or tab
if (_.contains(room.connected, self.userId)) {
roomStream.emit(self.userId, {
room: roomId,
type: 'error.duplicate',
error: {
status: 409,
description: 'Conflict: user is already connected to this room',
},
}
// enable tracing and caching
options.tracing = getSetting('apolloTracing', Meteor.isDevelopment);
options.cacheControl = true;
// note: custom default resolver doesn't currently work
// see https://github.com/apollographql/apollo-server/issues/716
// options.fieldResolver = (source, args, context, info) => {
// return source[info.fieldName];
// }
// Get the token from the header
if (req.headers.authorization) {
const token = req.headers.authorization;
check(token, String);
const hashedToken = _hashLoginToken(token);
// Get the user from the database
user = await Meteor.users.findOne(
{ 'services.resume.loginTokens.hashedToken': hashedToken },
);
if (user) {
//LESSWRONG: Set user in sentry scope
Sentry.configureScope((scope) => {
scope.setUser({id: user._id, email: user.email, username: user.username});
});
// identify user to any server-side analytics providers
runCallbacks('events.identify', user);
export default function validatedUpdate(userId, selector, mutator, options) {
check(mutator, Object);
options = _.clone(options) || {};
if (!LocalCollection._selectorIsIdPerhapsAsObject(selector)) {
throw new Error('validated update should be of a single ID');
}
// We don't support upserts because they don't fit nicely into allow/deny
// rules.
if (options.upsert) {
throw new Meteor.Error(
403,
'Access denied. Upserts not ' +
'allowed in a restricted collection.'
);
}
Meteor.publish("Cart", function (accountId, anonymousCarts, shopId) {
check(accountId, Match.Maybe(String));
check(anonymousCarts, Match.Maybe([Object]));
check(shopId, Match.Maybe(String));
const userId = Reaction.getUserId();
let account;
if (userId) {
account = Accounts.findOne({ userId }, { fields: { _id: 1 } });
}
const selectorOr = [];
// You can only see your own carts
if (account && account._id === accountId) {
const accountSelector = { accountId };
if (shopId) {
accountSelector.shopId = shopId;
}
selectorOr.push(accountSelector);
export default function handleValidateAuthToken({ body }, meetingId) {
const { userId, valid, waitForApproval } = body;
check(userId, String);
check(valid, Boolean);
check(waitForApproval, Boolean);
const selector = {
meetingId,
userId,
};
const User = Users.findOne(selector);
// If we dont find the user on our collection is a flash user and we can skip
if (!User) return;
// User already flagged so we skip
if (User.validated === valid) return;
const modifier = {
export function execMethod (context: string, methodName: string, ...args: any[]) {
check(methodName, String)
check(context, String)
let startTime = Date.now()
// this is essentially the same as MeteorPromiseCall, but rejects the promise on exception to
// allow handling it in the client code
let actionId = Random.id()
UserActionsLog.insert(literal({
_id: actionId,
clientAddress: this.connection.clientAddress,
userId: this.userId,
context: context,
method: methodName,
args: JSON.stringify(args),
timestamp: getCurrentTime()
}))
export function requestUserAuthToken (id: string, token: string, authUrl: string) {
let peripheralDevice = PeripheralDeviceSecurity.getPeripheralDevice(id, token, this)
if (!peripheralDevice) throw new Meteor.Error(404,"peripheralDevice '" + id + "' not found!")
if (peripheralDevice.type !== PeripheralDeviceAPI.DeviceType.SPREADSHEET) {
throw new Meteor.Error(400, 'can only request user auth token for peripheral device of spreadsheet type')
}
check(authUrl, String)
PeripheralDevices.update(peripheralDevice._id, {$set: {
accessTokenUrl: authUrl
}})
}
export function storeAccessToken (id: string, token: string, accessToken: any) {
cleanRoomHistory({ roomId, latest, oldest, inclusive = true, limit, excludePinned = false, ignoreThreads = true, filesOnly = false, fromUsers = [] }) {
check(roomId, String);
check(latest, Date);
check(oldest, Date);
check(inclusive, Boolean);
check(limit, Match.Maybe(Number));
check(excludePinned, Match.Maybe(Boolean));
check(filesOnly, Match.Maybe(Boolean));
check(fromUsers, Match.Maybe([String]));
const userId = Meteor.userId();
if (!userId) {
throw new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'cleanRoomHistory' });
}
if (!hasPermission(userId, 'clean-channel-history', roomId)) {
throw new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'cleanRoomHistory' });
}
return cleanRoomHistory({ rid: roomId, latest, oldest, inclusive, limit, excludePinned, ignoreThreads, filesOnly, fromUsers });
getRuntimeArgument (argumentId: string): IBlueprintRuntimeArgumentsItem | undefined {
check(argumentId, String)
if (!argumentId) {
throw new Meteor.Error(500, `RuntimeArgument id "${argumentId}" is invalid`)
}
return _.find(this.showStyleBase.runtimeArguments || [], ra => ra._id === argumentId)
}
insertRuntimeArgument (argumentId: string, argument: OmitId) {
Importer.process = function (json, keys, callback, cbArgs) {
check(json, String);
check(keys, Array);
check(callback, Function);
check(cbArgs, Array);
const array = EJSON.parse(json);
for (let inc = 0; inc < array.length; inc += 1) {
const key = {};
for (let subInc = 0; subInc < keys.length; subInc += 1) {
key[keys[subInc]] = array[inc][keys[subInc]];
}
callback.call(this, key, array[inc], ...cbArgs);
}
};