Files
pc_builder/app/controllers/computers_controller.ts
T
Kevin L'Hereec 3cc189c534 fix(security): close IDOR on computers/components update & destroy
- Scope update/destroy queries by userId (Computers & Components), matching
  the pattern already used in index/show/edit
- Add missing auth.authenticate() calls on destroy actions
- handleComponents now requires userId and scopes component lookups to the
  current user, preventing cross-user component takeover
- handleComponents rejects attaching more than one component of the same
  'unique' type to a computer (new InvalidComponentSelectionException, 422)
- handlePictures scopes picture lookups by computerId
- destroy(Computer) now detaches its components (computerId = null) instead
  of losing them to cascade delete, and removes the computer's uploads dir
- Switch store/update actions to request.validateUsing() for consistency
- Fix relative redirects to absolute paths (/computers, /computers/:id)
- Untrack .env.production and add it to .gitignore (secrets must not be
  committed); local file kept on disk
2026-07-23 10:53:13 +02:00

127 lines
4.6 KiB
TypeScript

import type { HttpContext } from '@adonisjs/core/http'
import { existsSync, rmSync } from 'node:fs'
import Computer from '#models/computer'
import ComputerState from '#models/computer_state'
import Component from '#models/component'
import { storeComputerValidator } from '#validators/Computers/store'
import { handleComponents } from '#services/component_service'
import { handlePictures } from '#services/picture_service'
import type { Image } from '#types/UItypes'
import { updateComputerValidator } from '#validators/Computers/update'
export default class ComputersController {
async index({ auth, inertia }: HttpContext) {
const user = await auth.authenticate()
const computers = await Computer.query()
.where('user_id', user.id)
.preload('state')
.preload('components')
.preload('pictures', (picturesQuery) => {
picturesQuery.where('order', 1)
})
return inertia.render('computers/index', { computers: computers.map((c) => c.serialize()) })
}
async create({ auth, inertia }: HttpContext) {
const user = await auth.authenticate()
const states = await ComputerState.all()
const components = await Component.query()
.where('userId', user.id)
.whereNull('computerId')
.preload('type')
return inertia.render('computers/create', { components: components.map((c) => c.serialize()), states: states.map((s) => s.serialize()) })
}
async store({ auth, request, response }: HttpContext) {
const user = await auth.authenticate()
const { pictures, componentsId, ...computerData } =
await request.validateUsing(storeComputerValidator)
await ComputerState.findOrFail(computerData.stateId)
const computer = await Computer.create({
...computerData,
userId: user.id,
})
await handleComponents(componentsId as number[], computer, user.id)
await handlePictures(pictures as Image[], request, computer)
return response.redirect('/computers')
}
async show({ auth, inertia, params }: HttpContext) {
const user = await auth.authenticate()
const computerId = params.id
const computer = await Computer.query()
.preload('state')
.preload('components', (componentsQuery) => {
componentsQuery.preload('type')
})
.preload('pictures', (picturesQuery) => {
picturesQuery.orderBy('order')
})
.where('user_id', user.id)
.andWhere('id', computerId)
.firstOrFail()
return inertia.render('computers/show', { computer: computer.serialize() })
}
async edit({ params, inertia, auth }: HttpContext) {
const user = await auth.authenticate()
const states = await ComputerState.all()
const computerId = params.id
const computer = await Computer.query()
.preload('state')
.preload('components', (componentsQuery) => {
componentsQuery.preload('type')
})
.preload('pictures')
.where('user_id', user.id)
.andWhere('id', computerId)
.firstOrFail()
const availableComponents = await Component.query()
.preload('type')
.where('user_id', user.id)
.whereNull('computer_id')
.whereNotIn(
'id',
computer.components.map((c) => c.id)
)
return inertia.render('computers/edit', { computer: computer.serialize(), availableComponents: availableComponents.map((c) => c.serialize()), states: states.map((s) => s.serialize()) })
}
async update({ auth, params, request, response }: HttpContext) {
const user = await auth.authenticate()
const computerId = params.id
const { pictures, componentsId, ...computerData } = await request.validateUsing(
updateComputerValidator
)
const computer = await Computer.query()
.where('user_id', user.id)
.andWhere('id', computerId)
.firstOrFail()
computer.merge(computerData)
await computer.save()
await handleComponents(componentsId as number[], computer, user.id)
await handlePictures(pictures as Image[], request, computer)
return response.redirect(`/computers/${computer.id}`)
}
async destroy({ auth, params, response }: HttpContext) {
const user = await auth.authenticate()
const computerId = params.id
const computer = await Computer.query()
.where('user_id', user.id)
.andWhere('id', computerId)
.firstOrFail()
const uploadsDir = `uploads/computer_${computer.id}`
await computer.related('components').query().update({ computerId: null })
if (existsSync(uploadsDir)) {
rmSync(uploadsDir, { recursive: true, force: true })
}
await computer.delete()
return response.redirect('/computers')
}
}