added token validation with input fields

src/lib/server/s3ClientService.ts

@@ -1,41 +1,4 @@
-import { client } from '$lib/minio';
-
-const BUCKET = 'tatort';
-
-export const getVorgang = ({ params }) => {
-	const prefix = params.vorgang ? `${params.vorgang}/` : '';
-	const stream = client.listObjectsV2('tatort', prefix, false, '');
-	const result = new ReadableStream({
-		start(controller) {
-			stream.on('data', (data) => {
-				if (prefix === '') {
-					if (data.prefix)
-						controller.enqueue(`${JSON.stringify({ ...data, name: data.prefix.slice(0, -1) })}\n`);
-					return;
-				}
-
-				const name = data.name.slice(prefix.length);
-				if (name === 'config.json') return;
-				// zugangscode datei
-				if (name === '__perm__') return;
-
-				controller.enqueue(`${JSON.stringify({ ...data, name, prefix })}\n`);
-			});
-			stream.on('end', () => {
-				controller.close();
-			});
-		},
-		cancel() {
-			stream.destroy();
-		}
-	});
-
-	return new Response(result, {
-		headers: {
-			'content-type': 'text/event-stream'
-		}
-	});
-};
+import { BUCKET, client } from '$lib/minio';
 
 
 export const checkIfExactDirectoryExists = (dir: string): Promise<boolean> => {

src/lib/server/vorgangService.ts

@@ -1,68 +1,97 @@
 import { fail, redirect } from '@sveltejs/kit';
-import { client } from '$lib/minio';
+import { BUCKET, client } from '$lib/minio';
 import { checkIfExactDirectoryExists } from './s3ClientService';
 
 /**
- * 
- * @param request 
- * @returns 
+ *
+ * @param request
+ * @returns
  */
-export const getVorgangByCaseNumber = async ( request: Request) => {
-        const data = await request.formData();
-        const caseNumber = data.get('caseNumber');
-        const user_token = data.get('token');
+export const redirectIfVorgangExists = async (request: Request) => {
+	const data = await request.formData();
+	const caseId = data.get('case-id');
+	const caseToken = data.get('case-token');
 
-        if (!caseNumber) {
-            return fail(400, {
-                success: false,
-                caseNumber,
-                error: { message: 'Die Vorgangsnummer darf nicht leer sein.' }
-            });
-        }
+	if (!caseId) {
+		return fail(400, {
+			success: false,
+			caseId,
+			error: { message: 'Die Vorgangsnummer darf nicht leer sein.' }
+		});
+	}
 
-        if (typeof caseNumber === 'string' && !(await checkIfExactDirectoryExists(caseNumber))) {
-            return fail(400, {
-                success: false,
-                caseNumber,
-                error: { message: 'Die Vorgangsnummer existiert in dieser Anwendung nicht.' }
-            });
-        }
+	if (typeof caseId === 'string' && !(await checkIfExactDirectoryExists(caseId))) {
+		return fail(400, {
+			success: false,
+			caseId,
+			error: { message: 'Die Vorgangsnummer existiert in dieser Anwendung nicht.' }
+		});
+	}
 
+	const isTokenValid = await hasValidToken(caseId, caseToken);
 
-        const token = await getTokenOrNull(caseNumber);
+	if (!isTokenValid) {
+		return fail(400, {
+			success: false,
+			caseId,
+			error: { message: 'Der Token ist ungültig.' }
+		});
+	}
 
-        if (token && token != user_token) {
-            return fail(400, {
-                success: false,
-                caseNumber,
-                error: { message: 'Der Token ist falsch.' }
-            });
-        }
+	redirect(303, `/list/${caseId}`);
+};
 
-        redirect(303, `/list/${caseNumber}`);
-    }
+export const getVorgangByCaseId = ({ params }) => {
+	const prefix = params.vorgang ? `${params.vorgang}/` : '';
+	const stream = client.listObjectsV2(BUCKET, prefix, false, '');
+	const result = new ReadableStream({
+		start(controller) {
+			stream.on('data', (data) => {
+				if (prefix === '') {
+					if (data.prefix)
+						controller.enqueue(`${JSON.stringify({ ...data, name: data.prefix.slice(0, -1) })}\n`);
+					return;
+				}
 
+				const name = data.name.slice(prefix.length);
+				if (name === 'config.json') return;
+				// zugangscode datei
+				if (name === '__perm__') return;
 
-const getTokenOrNull = async (vorgang) => {
-    const code_name = '__perm__';
-    const obj_path = `${vorgang}/${code_name}`;
+				controller.enqueue(`${JSON.stringify({ ...data, name, prefix })}\n`);
+			});
+			stream.on('end', () => {
+				controller.close();
+			});
+		},
+		cancel() {
+			stream.destroy();
+		}
+	});
 
-    let resp = null;
-    let code_saved = '';
+	return new Response(result, {
+		headers: {
+			'content-type': 'text/event-stream'
+		}
+	});
+};
 
-    try {
-        resp = await client.getObject('tatort', obj_path);
-        
-        code_saved = await new Response(resp).text();
-    } catch (error) {
-        if (error.name == 'S3Error') {
-            resp = null;
-        }
-    }
+const hasValidToken = async (caseId: string, caseToken: string) => {
+	const tokenFileName = '__perm__';
+	const objPath = `${caseId}/${tokenFileName}`;
 
-    if (resp != null) {
-        return code_saved;
-    } else {
-        return null;
-    }
-}
+	try {
+		if (!caseToken) return false;
+
+		const res = await client.getObject('tatort', objPath);
+
+		const savedToken = await new Response(res).text();
+
+		return savedToken === caseToken ? true : false;
+	} catch (error) {
+		if (error.name == 'S3Error') {
+			console.log(error);
+			return false;
+		}
+	}
+};