a36a4cac6b
Validation: the dump validators refuse the nulls their shared types don't allow (a null title or note on creation, a null URL on edit); a playlist title of spaces is refused and titles are stored trimmed; usernames and emails are checked by the same USERNAME_RE and EMAIL_RE in shared/validation.ts on sign-up, on PATCH /api/users/me (which checked other limits) and in the sign-up form. Mentions are read by shared/mention.ts's mentionedUsernames, which skips code and URLs as Markdown shows them: https://mastodon.social/@bob or a `@bob` in code notified bob; the editor's suggestions derive their trigger from the same pattern instead of a copy. Following an unknown user is a 404 rather than a foreign-key 500, and following a private playlist a 404 rather than a 403 that confirmed it exists. `ws` and `emojibase` are reserved category slugs, since the server answers them before the app. GET /api/users/me no longer turns every error into a 500. Dead code goes: adminOnlyMiddleware, verifyEmailTransport, listUsers, deleteUser with disconnectUser and the force_logout message only it sent, PATCH /api/notifications/:id/read (with markOneRead), isSlugAvailable, the unreachable 500 in fetchComment, and the `if (!ctx.state.user)` checks behind authMiddleware. 214 backend and 627 frontend tests pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
46 lines
1.6 KiB
TypeScript
46 lines
1.6 KiB
TypeScript
/**
|
|
* Serves the invite endpoints. Any signed-in user can invite someone, from
|
|
* their profile page, and the invite link opens the `/register` page.
|
|
*
|
|
* - `POST /api/invites` — signed in. Makes an invite and answers its token.
|
|
* - `GET /api/invites/:token` — public. Checks that an invite still works,
|
|
* before the register page shows its form; 404 when it doesn't.
|
|
*
|
|
* @module
|
|
*/
|
|
|
|
import { Router } from "@oak/oak";
|
|
import { type APIResponse } from "../../shared/api.ts";
|
|
import { APIException } from "../lib/api-exception.ts";
|
|
import type { InviteResponse } from "../../shared/user.ts";
|
|
import { type AuthContext, authMiddleware } from "../middleware/auth.ts";
|
|
import { createInvite, validateInvite } from "../services/invite-service.ts";
|
|
|
|
/**
|
|
* Mounted by `api/main.ts` behind the error, Open Graph and CORS middleware.
|
|
* An `APIException` thrown by a handler becomes the JSON error response there.
|
|
*/
|
|
const router: Router = new Router({ prefix: "/api/invites" });
|
|
|
|
router.post("/", authMiddleware, (ctx: AuthContext) => {
|
|
const responseBody: APIResponse<InviteResponse> = {
|
|
success: true,
|
|
data: { token: createInvite(ctx.state.user.userId) },
|
|
};
|
|
ctx.response.status = 201;
|
|
ctx.response.body = responseBody;
|
|
});
|
|
|
|
router.get("/:token", (ctx) => {
|
|
// A used invite answers 404 too: the page only needs to know it won't work.
|
|
try {
|
|
validateInvite(ctx.params.token);
|
|
const responseBody: APIResponse<null> = { success: true, data: null };
|
|
ctx.response.body = responseBody;
|
|
} catch {
|
|
throw new APIException(404, "Invalid or expired invite");
|
|
}
|
|
});
|
|
|
|
export default router;
|