use strict zod objects and hide proto on targets

server/routers/auth/verifySiteAccess.ts

@@ -10,6 +10,7 @@ import {
 import { and, eq, or } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
+import logger from "@server/logger";
 
 export async function verifySiteAccess(
     req: Request,
@@ -28,6 +29,7 @@ export async function verifySiteAccess(
     }
 
     if (isNaN(siteId)) {
+        logger.debug(JSON.stringify(req.body));
         return next(createHttpError(HttpCode.BAD_REQUEST, "Invalid site ID"));
     }
 

server/routers/external.ts

@@ -150,7 +150,6 @@ authenticated.get(
 authenticated.post(
     "/resource/:resourceId",
     verifyResourceAccess,
-    verifySiteAccess,
     verifyUserHasAction(ActionsEnum.updateResource),
     resource.updateResource
 );

server/routers/org/createOrg.ts

@@ -12,11 +12,13 @@ import config from "@server/config";
 import { fromError } from "zod-validation-error";
 import { defaultRoleAllowedActions } from "../role";
 
-const createOrgSchema = z.object({
-    orgId: z.string(),
-    name: z.string().min(1).max(255),
-    // domain: z.string().min(1).max(255).optional(),
-});
+const createOrgSchema = z
+    .object({
+        orgId: z.string(),
+        name: z.string().min(1).max(255),
+        // domain: z.string().min(1).max(255).optional(),
+    })
+    .strict();
 
 const MAX_ORGS = 5;
 

server/routers/org/updateOrg.ts

@@ -18,6 +18,7 @@ const updateOrgBodySchema = z
         name: z.string().min(1).max(255).optional(),
         domain: z.string().min(1).max(255).optional(),
     })
+    .strict()
     .refine((data) => Object.keys(data).length > 0, {
         message: "At least one field must be provided for update",
     });

server/routers/resource/createResource.ts

@@ -25,10 +25,12 @@ const createResourceParamsSchema = z.object({
     orgId: z.string(),
 });
 
-const createResourceSchema = z.object({
-    name: z.string().min(1).max(255),
-    subdomain: z.string().min(1).max(255).optional(),
-});
+const createResourceSchema = z
+    .object({
+        name: z.string().min(1).max(255),
+        subdomain: z.string().min(1).max(255).optional(),
+    })
+    .strict();
 
 export type CreateResourceResponse = Resource;
 

server/routers/resource/updateResource.ts

@@ -18,8 +18,9 @@ const updateResourceBodySchema = z
         name: z.string().min(1).max(255).optional(),
         subdomain: z.string().min(1).max(255).optional(),
         ssl: z.boolean().optional(),
-        siteId: z.number(),
+        // siteId: z.number(),
     })
+    .strict()
     .refine((data) => Object.keys(data).length > 0, {
         message: "At least one field must be provided for update",
     });

server/routers/role/createRole.ts

@@ -14,10 +14,12 @@ const createRoleParamsSchema = z.object({
     orgId: z.string(),
 });
 
-const createRoleSchema = z.object({
-    name: z.string().min(1).max(255),
-    description: z.string().optional(),
-});
+const createRoleSchema = z
+    .object({
+        name: z.string().min(1).max(255),
+        description: z.string().optional(),
+    })
+    .strict();
 
 export const defaultRoleAllowedActions: ActionsEnum[] = [
     ActionsEnum.getOrg,

server/routers/role/updateRole.ts

@@ -18,6 +18,7 @@ const updateRoleBodySchema = z
         name: z.string().min(1).max(255).optional(),
         description: z.string().optional(),
     })
+    .strict()
     .refine((data) => Object.keys(data).length > 0, {
         message: "At least one field must be provided for update",
     });

server/routers/site/createSite.ts

@@ -15,13 +15,15 @@ const createSiteParamsSchema = z.object({
     orgId: z.string(),
 });
 
-const createSiteSchema = z.object({
-    name: z.string().min(1).max(255),
-    exitNodeId: z.number().int().positive(),
-    subdomain: z.string().min(1).max(255).optional(),
-    pubKey: z.string(),
-    subnet: z.string(),
-});
+const createSiteSchema = z
+    .object({
+        name: z.string().min(1).max(255),
+        exitNodeId: z.number().int().positive(),
+        subdomain: z.string().min(1).max(255).optional(),
+        pubKey: z.string(),
+        subnet: z.string(),
+    })
+    .strict();
 
 export type CreateSiteResponse = {
     name: string;

server/routers/site/updateSite.ts

@@ -23,6 +23,7 @@ const updateSiteBodySchema = z
         megabytesIn: z.number().int().nonnegative().optional(),
         megabytesOut: z.number().int().nonnegative().optional(),
     })
+    .strict()
     .refine((data) => Object.keys(data).length > 0, {
         message: "At least one field must be provided for update",
     });

server/routers/target/createTarget.ts

@@ -15,13 +15,15 @@ const createTargetParamsSchema = z.object({
     resourceId: z.string().transform(Number).pipe(z.number().int().positive()),
 });
 
-const createTargetSchema = z.object({
-    ip: z.string().ip(),
-    method: z.string().min(1).max(10),
-    port: z.number().int().min(1).max(65535),
-    protocol: z.string().optional(),
-    enabled: z.boolean().default(true),
-});
+const createTargetSchema = z
+    .object({
+        ip: z.string().ip(),
+        method: z.string().min(1).max(10),
+        port: z.number().int().min(1).max(65535),
+        protocol: z.string().optional(),
+        enabled: z.boolean().default(true),
+    })
+    .strict();
 
 export type CreateTargetResponse = Target;
 
@@ -104,6 +106,7 @@ export async function createTarget(
             .insert(targets)
             .values({
                 resourceId,
+                protocol: "tcp", // hard code for now
                 ...targetData,
             })
             .returning();

server/routers/target/updateTarget.ts

@@ -15,12 +15,12 @@ const updateTargetParamsSchema = z.object({
 
 const updateTargetBodySchema = z
     .object({
-        // ip: z.string().ip().optional(), // for now we cant update the ip; you will have to delete
+        ip: z.string().ip().optional(), // for now we cant update the ip; you will have to delete
         method: z.string().min(1).max(10).optional(),
         port: z.number().int().min(1).max(65535).optional(),
-        protocol: z.string().optional(),
         enabled: z.boolean().optional(),
     })
+    .strict()
     .refine((data) => Object.keys(data).length > 0, {
         message: "At least one field must be provided for update",
     });