yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 09:36:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(access-control): implement project access control for audio and image uploads

Browse Source
This commit is contained in:
Yusuf İpek
2026-04-10 21:27:52 +03:00
parent c92181b90f
commit 3d0e430230
3 changed files with 126 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/upload/audio/[filename]/route.ts
+64 -1
View File
@@ -1,3 +1,8 @@
import { NextRequest } from 'next/server';
import { auth, checkProjectAccess } from '@/lib/auth';
import { db } from '@/lib/db';
import { validateShareLinkAccess } from '@/lib/share-links';
import { getShareSessionFromRequest } from '@/lib/share-session';
import { apiErrors } from '@/lib/api-response';
import { proxyR2MediaObject } from '@/lib/r2-media-proxy';
import { logError } from '@/lib/logger';
@@ -20,7 +25,7 @@ function getContentType(filename: string): string {
}
export async function GET(
request: Request,
request: NextRequest,
{ params }: { params: Promise<{ filename: string }> }
) {
try {
@@ -31,12 +36,70 @@ export async function GET(
return apiErrors.badRequest('Invalid filename');
}
// Parallelize the DB lookup and session check to narrow the timing delta
// between "asset not found" and "asset found, access denied" responses.
const voiceUrl = `/api/upload/audio/${filename}`;
const [comment, session] = await Promise.all([
db.comment.findFirst({
where: { voiceUrl },
select: {
version: {
select: {
video: {
select: {
id: true,
projectId: true,
project: {
select: {
id: true,
ownerId: true,
workspaceId: true,
visibility: true,
},
},
},
},
},
},
},
}),
auth(),
]);
if (!comment) {
return apiErrors.forbidden('Access denied');
}
const { video } = comment.version;
const access = await checkProjectAccess(video.project, session?.user?.id);
if (!access.hasAccess) {
const shareSession = getShareSessionFromRequest(request, video.id);
const shareAccess = shareSession
? await validateShareLinkAccess({
token: shareSession.token,
projectId: video.projectId,
videoId: video.id,
requiredPermission: 'VIEW',
passwordVerified: shareSession.passwordVerified,
})
: null;
if (!shareAccess?.hasAccess) {
return apiErrors.forbidden('Access denied');
}
}
const key = `voice/${filename}`;
return proxyR2MediaObject({
request,
key,
fallbackContentType: getContentType(filename),
cacheControl: 'private, no-store',
extraHeaders: {
'X-Content-Type-Options': 'nosniff',
'Content-Security-Policy': "default-src 'none'; sandbox",
},
internalErrorMessage: 'Failed to retrieve audio',
});
} catch (error: unknown) {
app/api/upload/image/[filename]/route.ts
+60 -1
View File
@@ -1,3 +1,8 @@
import { NextRequest } from 'next/server';
import { auth, checkProjectAccess } from '@/lib/auth';
import { db } from '@/lib/db';
import { validateShareLinkAccess } from '@/lib/share-links';
import { getShareSessionFromRequest } from '@/lib/share-session';
import { apiErrors } from '@/lib/api-response';
import { proxyR2MediaObject } from '@/lib/r2-media-proxy';
import { logError } from '@/lib/logger';
@@ -18,7 +23,7 @@ function getContentType(filename: string): string {
}
export async function GET(
request: Request,
request: NextRequest,
{ params }: { params: Promise<{ filename: string }> }
) {
try {
@@ -29,6 +34,60 @@ export async function GET(
return apiErrors.badRequest('Invalid filename');
}
// Parallelize the DB lookup and session check to narrow the timing delta
// between "asset not found" and "asset found, access denied" responses.
const imageUrl = `/api/upload/image/${filename}`;
const [comment, session] = await Promise.all([
db.comment.findFirst({
where: { imageUrl },
select: {
version: {
select: {
video: {
select: {
id: true,
projectId: true,
project: {
select: {
id: true,
ownerId: true,
workspaceId: true,
visibility: true,
},
},
},
},
},
},
},
}),
auth(),
]);
if (!comment) {
return apiErrors.forbidden('Access denied');
}
const { video } = comment.version;
const access = await checkProjectAccess(video.project, session?.user?.id);
if (!access.hasAccess) {
const shareSession = getShareSessionFromRequest(request, video.id);
const shareAccess = shareSession
? await validateShareLinkAccess({
token: shareSession.token,
projectId: video.projectId,
videoId: video.id,
requiredPermission: 'VIEW',
passwordVerified: shareSession.passwordVerified,
})
: null;
if (!shareAccess?.hasAccess) {
return apiErrors.forbidden('Access denied');
}
}
const key = `images/${filename}`;
return proxyR2MediaObject({
request,
prisma/schema.prisma
+2
View File
@@ -466,6 +466,8 @@ model Comment {
@@index([guestIdentityId])
@@index([timestamp])
@@index([tagId])
@@unique([imageUrl])
@@unique([voiceUrl])
@@index([versionId, isResolved, timestamp])
@@index([versionId, parentId, createdAt])
@@map("comments")