Remove dangerous logging

This commit is contained in:
Owen Schwartz 2024-12-22 12:03:46 -05:00
parent 3fb3be1f1e
commit 1361b47ef7
No known key found for this signature in database
GPG key ID: 8271FDFFD9E0CCBD
8 changed files with 190 additions and 36 deletions

View file

@ -10,6 +10,7 @@ export enum ActionsEnum {
// deleteOrg = "deleteOrg", // deleteOrg = "deleteOrg",
getOrg = "getOrg", getOrg = "getOrg",
updateOrg = "updateOrg", updateOrg = "updateOrg",
deleteOrg = "deleteOrg",
createSite = "createSite", createSite = "createSite",
deleteSite = "deleteSite", deleteSite = "deleteSite",
getSite = "getSite", getSite = "getSite",

View file

@ -29,7 +29,6 @@ export async function verifySiteAccess(
} }
if (isNaN(siteId)) { if (isNaN(siteId)) {
logger.debug(JSON.stringify(req.body));
return next(createHttpError(HttpCode.BAD_REQUEST, "Invalid site ID")); return next(createHttpError(HttpCode.BAD_REQUEST, "Invalid site ID"));
} }

View file

@ -126,8 +126,6 @@ export async function login(
await createSession(token, existingUser.userId); await createSession(token, existingUser.userId);
const cookie = serializeSessionCookie(token); const cookie = serializeSessionCookie(token);
logger.debug(cookie);
res.appendHeader("Set-Cookie", cookie); res.appendHeader("Set-Cookie", cookie);
if ( if (

View file

@ -75,8 +75,6 @@ export async function requestPasswordReset(
// TODO: send email with link to reset password on dashboard // TODO: send email with link to reset password on dashboard
// something like: https://example.com/auth/reset-password?email=${email}&?token=${token} // something like: https://example.com/auth/reset-password?email=${email}&?token=${token}
// for now, just log the token // for now, just log the token
logger.debug(`Password reset token: ${token}`);
return response<RequestPasswordResetResponse>(res, { return response<RequestPasswordResetResponse>(res, {
data: { data: {
sentEmail: true, sentEmail: true,

View file

@ -1,7 +1,13 @@
import { Request, Response, NextFunction } from "express"; import { Request, Response, NextFunction } from "express";
import { z } from "zod"; import { z } from "zod";
import { db } from "@server/db"; import { db } from "@server/db";
import { orgs, userActions } from "@server/db/schema"; import {
newts,
newtSessions,
orgs,
sites,
userActions
} from "@server/db/schema";
import { eq } from "drizzle-orm"; import { eq } from "drizzle-orm";
import response from "@server/utils/response"; import response from "@server/utils/response";
import HttpCode from "@server/types/HttpCode"; import HttpCode from "@server/types/HttpCode";
@ -9,9 +15,11 @@ import createHttpError from "http-errors";
import { ActionsEnum, checkUserActionPermission } from "@server/auth/actions"; import { ActionsEnum, checkUserActionPermission } from "@server/auth/actions";
import logger from "@server/logger"; import logger from "@server/logger";
import { fromError } from "zod-validation-error"; import { fromError } from "zod-validation-error";
import { sendToClient } from "../ws";
import { deletePeer } from "../gerbil/peers";
const deleteOrgSchema = z.object({ const deleteOrgSchema = z.object({
orgId: z.string(), orgId: z.string()
}); });
export async function deleteOrg( export async function deleteOrg(
@ -32,26 +40,27 @@ export async function deleteOrg(
const { orgId } = parsedParams.data; const { orgId } = parsedParams.data;
// // Check if the user has permission to list sites // Check if the user has permission to list sites
// const hasPermission = await checkUserActionPermission( const hasPermission = await checkUserActionPermission(
// ActionsEnum.deleteOrg, ActionsEnum.deleteOrg,
// req req
// ); );
// if (!hasPermission) { if (!hasPermission) {
// return next( return next(
// createHttpError( createHttpError(
// HttpCode.FORBIDDEN, HttpCode.FORBIDDEN,
// "User does not have permission to perform this action" "User does not have permission to perform this action"
// ) )
// ); );
// } }
const deletedOrg = await db const [org] = await db
.delete(orgs) .select()
.from(orgs)
.where(eq(orgs.orgId, orgId)) .where(eq(orgs.orgId, orgId))
.returning(); .limit(1);
if (deletedOrg.length === 0) { if (!org) {
return next( return next(
createHttpError( createHttpError(
HttpCode.NOT_FOUND, HttpCode.NOT_FOUND,
@ -60,12 +69,53 @@ export async function deleteOrg(
); );
} }
// we need to handle deleting each site
const orgSites = await db
.select()
.from(sites)
.where(eq(sites.orgId, orgId))
.limit(1);
if (sites) {
for (const site of orgSites) {
if (site.pubKey) {
if (site.type == "wireguard") {
await deletePeer(site.exitNodeId!, site.pubKey);
} else if (site.type == "newt") {
// get the newt on the site by querying the newt table for siteId
const [deletedNewt] = await db
.delete(newts)
.where(eq(newts.siteId, site.siteId))
.returning();
if (deletedNewt) {
const payload = {
type: `newt/terminate`,
data: {}
};
sendToClient(deletedNewt.newtId, payload);
// delete all of the sessions for the newt
db.delete(newtSessions)
.where(
eq(newtSessions.newtId, deletedNewt.newtId)
)
.run();
}
}
}
db.delete(sites).where(eq(sites.siteId, site.siteId)).run();
}
}
await db.delete(orgs).where(eq(orgs.orgId, orgId)).returning();
return response(res, { return response(res, {
data: null, data: null,
success: true, success: true,
error: false, error: false,
message: "Organization deleted successfully", message: "Organization deleted successfully",
status: HttpCode.OK, status: HttpCode.OK
}); });
} catch (error) { } catch (error) {
logger.error(error); logger.error(error);

View file

@ -16,7 +16,7 @@ const updateOrgParamsSchema = z.object({
const updateOrgBodySchema = z const updateOrgBodySchema = z
.object({ .object({
name: z.string().min(1).max(255).optional(), name: z.string().min(1).max(255).optional(),
domain: z.string().min(1).max(255).optional(), // domain: z.string().min(1).max(255).optional(),
}) })
.strict() .strict()
.refine((data) => Object.keys(data).length > 0, { .refine((data) => Object.keys(data).length > 0, {

View file

@ -104,7 +104,6 @@ export async function authWithAccessToken(
// outputLen: 32, // outputLen: 32,
// parallelism: 1 // parallelism: 1
// }); // });
logger.debug(`${accessToken} ${tokenItem.tokenHash}`)
const validCode = accessToken === tokenItem.tokenHash; const validCode = accessToken === tokenItem.tokenHash;
if (!validCode) { if (!validCode) {

View file

@ -4,16 +4,85 @@ import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
import { Button } from "@app/components/ui/button"; import { Button } from "@app/components/ui/button";
import { useOrgContext } from "@app/hooks/useOrgContext"; import { useOrgContext } from "@app/hooks/useOrgContext";
import { userOrgUserContext } from "@app/hooks/useOrgUserContext"; import { userOrgUserContext } from "@app/hooks/useOrgUserContext";
import { useToast } from "@app/hooks/useToast";
import { useState } from "react"; import { useState } from "react";
import {
Form,
FormControl,
FormDescription,
FormField,
FormItem,
FormLabel,
FormMessage
} from "@/components/ui/form";
import { Input } from "@/components/ui/input";
import { z } from "zod";
import { useForm } from "react-hook-form";
import { zodResolver } from "@hookform/resolvers/zod";
import { createApiClient } from "@app/api";
import { useEnvContext } from "@app/hooks/useEnvContext";
import { formatAxiosError } from "@app/lib/utils";
import { AlertTriangle, Trash2 } from "lucide-react";
import {
Card,
CardContent,
CardFooter,
CardHeader,
CardTitle
} from "@/components/ui/card";
const GeneralFormSchema = z.object({
name: z.string()
});
type GeneralFormValues = z.infer<typeof GeneralFormSchema>;
export default function GeneralPage() { export default function GeneralPage() {
const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false); const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
const { orgUser } = userOrgUserContext(); const { orgUser } = userOrgUserContext();
const { org } = useOrgContext(); const { org } = useOrgContext();
const { toast } = useToast();
const api = createApiClient(useEnvContext());
const form = useForm<GeneralFormValues>({
resolver: zodResolver(GeneralFormSchema),
defaultValues: {
name: org?.org.name
},
mode: "onChange"
});
async function deleteOrg() { async function deleteOrg() {
console.log("not implemented"); await api
.delete(`/org/${org?.org.orgId}`)
.catch((e) => {
toast({
variant: "destructive",
title: "Failed to delete org",
description: formatAxiosError(
e,
"An error occurred while deleting the org."
),
});
});
}
async function onSubmit(data: GeneralFormValues) {
await api
.post(`/org/${org?.org.orgId}`, {
name: data.name
})
.catch((e) => {
toast({
variant: "destructive",
title: "Failed to update org",
description: formatAxiosError(
e,
"An error occurred while updating the org."
)
});
});
} }
return ( return (
@ -46,15 +115,55 @@ export default function GeneralPage() {
title="Delete organization" title="Delete organization"
/> />
<div className="space-y-8"> <Form {...form}>
{orgUser.isOwner ? ( <form
<Button onClick={() => setIsDeleteModalOpen(true)}> onSubmit={form.handleSubmit(onSubmit)}
Delete Organization className="space-y-8 max-w-lg"
>
<FormField
control={form.control}
name="name"
render={({ field }) => (
<FormItem>
<FormLabel>Name</FormLabel>
<FormControl>
<Input {...field} />
</FormControl>
<FormDescription>
This is the display name of the org
</FormDescription>
<FormMessage />
</FormItem>
)}
/>
<Button type="submit">Save Changes</Button>
</form>
</Form>
<Card className="max-w-lg border-red-900 mt-5">
<CardHeader>
<CardTitle className="flex items-center gap-2 text-red-600">
<AlertTriangle className="h-5 w-5" />
Danger Zone
</CardTitle>
</CardHeader>
<CardContent>
<p className="text-sm mb-4">
Once you delete this org, there is no going back. Please
be certain.
</p>
</CardContent>
<CardFooter className="flex justify-end gap-2">
<Button
variant="destructive"
onClick={() => setIsDeleteModalOpen(true)}
className="flex items-center gap-2"
>
<Trash2 className="h-4 w-4" />
Delete
</Button> </Button>
) : ( </CardFooter>
<p>Nothing to see here</p> </Card>
)}
</div>
</> </>
); );
} }