Ownership was checked ad hoc: some handlers loaded-and-compared ownerId, some lib mutators enforced it in WHERE clauses and silently no-op'd for non-owners, and nothing tied the two together. Two real authorization bugs hid in the gaps: linkActivityToRoute ignored its ownerId parameter entirely (any logged-in user could relink any activity), and createRouteFromActivity loaded any activity without an ownership check (a non-owner could copy a private activity's GPX into their own route). PUT /api/v1/routes/:id also returned ok:true for non-owners without updating anything. ownership.server.ts is now the single enforcement point: - loadOwnedRoute / loadOwnedActivity (non-throwing, for callers with their own error vocabulary) and requireOwnedRoute / requireOwnedActivity (throwing data() 404/403 for web handlers; 404 by default so guessed ids don't leak existence) - the returned entities carry an Owned<> brand; mutators (updateRoute, deleteRoute, deleteActivity, updateActivityVisibility, linkActivityToRoute, createRouteFromActivity) now require an OwnedRef, so skipping the check is a compile error - vouchOwnership is the explicit, greppable escape hatch for the one non-session authorization path (the Planner JWT callback) - WHERE ownerId clauses stay in the mutators as defense in depth Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
117 lines
3.9 KiB
TypeScript
117 lines
3.9 KiB
TypeScript
// Orchestrates a route push: load route, check ownership, check scopes,
|
|
// build the RoutePushInput, and invoke the provider's RoutePusher
|
|
// capability. Replaces the legacy pushRouteToProvider in lib/sync.
|
|
//
|
|
// The pusher (per-provider) handles HTTP, FIT conversion, idempotency,
|
|
// and PUT/POST/404 fallback. This module is the orchestration layer
|
|
// callers use (route handlers, OAuth callback resume).
|
|
|
|
import { desc, eq } from "drizzle-orm";
|
|
import { parseGpxAsync } from "@trails-cool/gpx";
|
|
import { routeVersions } from "@trails-cool/db/schema/journal";
|
|
import { getDb } from "../db.ts";
|
|
import { loadOwnedRoute } from "../ownership.server.ts";
|
|
import {
|
|
ConnectionNotActiveError,
|
|
NeedsRelinkError,
|
|
} from "./types.ts";
|
|
import { capabilityContextFor, getService } from "./manager.ts";
|
|
import { getManifest, type RoutePushInput } from "./registry.ts";
|
|
|
|
export type PushOutcome =
|
|
| { status: "success"; remoteId: string; pushedAt: Date }
|
|
| { status: "scope_missing" }
|
|
| { status: "no_connection" }
|
|
| { status: "not_owner" }
|
|
| { status: "not_found" }
|
|
| { status: "unsupported_provider" }
|
|
| { status: "no_geometry" }
|
|
| { status: "needs_relink" }
|
|
| {
|
|
status: "error";
|
|
code: "validation" | "rate_limit" | "token_expired" | "generic";
|
|
message: string;
|
|
};
|
|
|
|
export interface PushRouteOptions {
|
|
userId: string;
|
|
providerId: string;
|
|
routeId: string;
|
|
}
|
|
|
|
export async function pushRouteToProvider(
|
|
opts: PushRouteOptions,
|
|
): Promise<PushOutcome> {
|
|
const { userId, providerId, routeId } = opts;
|
|
const db = getDb();
|
|
|
|
const manifest = getManifest(providerId);
|
|
if (!manifest) return { status: "not_found" };
|
|
if (!manifest.routePusher) return { status: "unsupported_provider" };
|
|
|
|
const loaded = await loadOwnedRoute(routeId, userId);
|
|
if (!loaded.ok) {
|
|
return { status: loaded.reason === "not_found" ? "not_found" : "not_owner" };
|
|
}
|
|
const route = loaded.entity;
|
|
|
|
const service = await getService(userId, providerId);
|
|
if (!service) return { status: "no_connection" };
|
|
if (!service.grantedScopes.includes("routes_write")) {
|
|
return { status: "scope_missing" };
|
|
}
|
|
|
|
// Pull the locked-in version GPX (not routes.gpx, which is the working copy).
|
|
const [latestVersion] = await db
|
|
.select()
|
|
.from(routeVersions)
|
|
.where(eq(routeVersions.routeId, routeId))
|
|
.orderBy(desc(routeVersions.version))
|
|
.limit(1);
|
|
|
|
const versionGpx = latestVersion?.gpx ?? route.gpx;
|
|
const versionNumber = latestVersion?.version ?? 1;
|
|
if (!versionGpx) return { status: "no_geometry" };
|
|
|
|
const parsed = await parseGpxAsync(versionGpx);
|
|
const points = parsed.tracks.flat();
|
|
if (points.length === 0) return { status: "no_geometry" };
|
|
|
|
const input: RoutePushInput = {
|
|
routeId,
|
|
routeName: route.name,
|
|
description: route.description ?? undefined,
|
|
gpx: versionGpx,
|
|
startLat: points[0]!.lat,
|
|
startLng: points[0]!.lon,
|
|
distance: parsed.distance,
|
|
ascent: parsed.elevation.gain,
|
|
localVersion: versionNumber,
|
|
};
|
|
|
|
try {
|
|
const ctx = capabilityContextFor(service.id);
|
|
const result = await manifest.routePusher.pushRoute(ctx, input);
|
|
return {
|
|
status: "success",
|
|
remoteId: result.remoteId,
|
|
pushedAt: new Date(),
|
|
};
|
|
} catch (err) {
|
|
if (err instanceof NeedsRelinkError) return { status: "needs_relink" };
|
|
if (err instanceof ConnectionNotActiveError) return { status: "needs_relink" };
|
|
const message = err instanceof Error ? err.message : String(err);
|
|
// Map known HTTP-shape errors. The pusher throws Error / WahooHttpError;
|
|
// we don't try to recover further here.
|
|
if (message.includes("422")) {
|
|
return { status: "error", code: "validation", message };
|
|
}
|
|
if (message.includes("429")) {
|
|
return { status: "error", code: "rate_limit", message };
|
|
}
|
|
if (message.includes("401") || message.includes("403")) {
|
|
return { status: "error", code: "token_expired", message };
|
|
}
|
|
return { status: "error", code: "generic", message };
|
|
}
|
|
}
|