From 04608d5db7b9e56b24ec4f9ea0de3b1b1b2d0948 Mon Sep 17 00:00:00 2001 From: zkldi <20380519+zkldi@users.noreply.github.com> Date: Wed, 16 Mar 2022 18:22:12 +0000 Subject: [PATCH 1/5] Unscrew version info --- server/src/lib/constants/version.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/src/lib/constants/version.ts b/server/src/lib/constants/version.ts index 62b51c128..05c3959d5 100644 --- a/server/src/lib/constants/version.ts +++ b/server/src/lib/constants/version.ts @@ -4,7 +4,7 @@ const MAJOR = 2; const MINOR = 1; -const PATCH = r; +const PATCH = 6; // As is with all front-facing zkldi projects, the version names for tachi-server // are from an album I like. In this case, the album is Portishead - Dummy. From b68b37797fc8c90265dd5d0151b7d0a3c9fb82c6 Mon Sep 17 00:00:00 2001 From: zkldi <20380519+zkldi@users.noreply.github.com> Date: Sun, 20 Mar 2022 14:58:03 +0000 Subject: [PATCH 2/5] bug: Force Static Import should actually matter. --- server/package.json | 2 +- server/src/lib/constants/version.ts | 2 +- .../src/server/router/ir/fervidex/router.test.ts | 15 +++++++++++++++ server/src/server/router/ir/fervidex/router.ts | 9 ++++++++- 4 files changed, 25 insertions(+), 3 deletions(-) diff --git a/server/package.json b/server/package.json index 5b78ad021..e2417f6cf 100644 --- a/server/package.json +++ b/server/package.json @@ -1,6 +1,6 @@ { "name": "tachi-server", - "version": "2.1.6", + "version": "2.1.7", "description": "A score tracking server.", "main": "js/index.js", "private": true, diff --git a/server/src/lib/constants/version.ts b/server/src/lib/constants/version.ts index 05c3959d5..d0d611f99 100644 --- a/server/src/lib/constants/version.ts +++ b/server/src/lib/constants/version.ts @@ -4,7 +4,7 @@ const MAJOR = 2; const MINOR = 1; -const PATCH = 6; +const PATCH = 7; // As is with all front-facing zkldi projects, the version names for tachi-server // are from an album I like. In this case, the album is Portishead - Dummy. diff --git a/server/src/server/router/ir/fervidex/router.test.ts b/server/src/server/router/ir/fervidex/router.test.ts index f80361666..b5a3dbec5 100644 --- a/server/src/server/router/ir/fervidex/router.test.ts +++ b/server/src/server/router/ir/fervidex/router.test.ts @@ -457,5 +457,20 @@ t.test("POST /ir/fervidex/profile/submit", (t) => { t.end(); }); + t.test("Should disallow requests from non INF2 if forceStaticImport is false.", async (t) => { + await db["fer-settings"].update({ userID: 1 }, { $set: { forceStaticImport: false } }); + + const res = await mockApi + .post("/ir/fervidex/profile/submit") + .set("Authorization", "Bearer mock_token") + .set("User-Agent", "fervidex/1.3.0") + .set("X-Software-Model", "LDJ:J:B:A:2020092900") + .send(ferStaticBody); + + t.equal(res.statusCode, 400, "Should be rejected, as FSI is not set."); + + t.end(); + }); + t.end(); }); diff --git a/server/src/server/router/ir/fervidex/router.ts b/server/src/server/router/ir/fervidex/router.ts index fa81417b8..d606bd9e1 100644 --- a/server/src/server/router/ir/fervidex/router.ts +++ b/server/src/server/router/ir/fervidex/router.ts @@ -92,7 +92,14 @@ const RequireInf2ModelHeaderOrForceStatic: RequestHandler = async (req, res, nex } try { - ParseEA3SoftID(swModel); + const { model } = ParseEA3SoftID(swModel); + + if (model !== MODEL_INFINITAS_2) { + return res.status(400).json({ + success: false, + error: `Refusing to perform static import from non-infinitas client. To do this anyway, enable Force Static Import.`, + }); + } } catch (err) { logger.info(`Invalid softID from ${req[SYMBOL_TachiAPIAuth].userID!}.`, { err }); return res.status(400).json({ From 89519485822a7bb357e73efcc15f6f432e9fc06b Mon Sep 17 00:00:00 2001 From: zkldi <20380519+zkldi@users.noreply.github.com> Date: Mon, 21 Mar 2022 00:18:29 +0000 Subject: [PATCH 3/5] fix: OAuth2 should expire codes after being used. --- server/src/server/router/api/v1/config/router.ts | 2 ++ server/src/server/router/api/v1/oauth/router.ts | 3 +++ 2 files changed, 5 insertions(+) diff --git a/server/src/server/router/api/v1/config/router.ts b/server/src/server/router/api/v1/config/router.ts index 97fb7b8d9..f98f734bf 100644 --- a/server/src/server/router/api/v1/config/router.ts +++ b/server/src/server/router/api/v1/config/router.ts @@ -7,6 +7,8 @@ const router: Router = Router({ mergeParams: true }); /** * Returns Tachi Configuration info, such as server name, type, supported games * and more. + * + * @name GET /api/v1/config */ router.get("/", (req, res) => res.status(200).json({ diff --git a/server/src/server/router/api/v1/oauth/router.ts b/server/src/server/router/api/v1/oauth/router.ts index 247679288..c1458cd15 100644 --- a/server/src/server/router/api/v1/oauth/router.ts +++ b/server/src/server/router/api/v1/oauth/router.ts @@ -67,6 +67,9 @@ router.post( }); } + // don't let people auth with the same code multiple times. + await db["oauth2-auth-codes"].remove({ code: req.body.code }); + const apiDoc = { userID: codeDoc.userID, token: Random20Hex(), From 9ea89b3b2c048c4352372bd43b477939ea75029a Mon Sep 17 00:00:00 2001 From: zkldi <20380519+zkldi@users.noreply.github.com> Date: Mon, 21 Mar 2022 00:19:05 +0000 Subject: [PATCH 4/5] Add regression test --- server/src/server/router/api/v1/oauth/router.test.ts | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/server/src/server/router/api/v1/oauth/router.test.ts b/server/src/server/router/api/v1/oauth/router.test.ts index f55c9563e..306d9194f 100644 --- a/server/src/server/router/api/v1/oauth/router.test.ts +++ b/server/src/server/router/api/v1/oauth/router.test.ts @@ -32,6 +32,10 @@ t.test("POST /api/v1/oauth/token", (t) => { "Should assign the permissions this client has configured." ); + const exists = await db["oauth2-auth-codes"].findOne({ code: "AUTH_CODE" }); + + t.equal(exists, null, "Should remove the code from the database after being used."); + t.end(); }); From a407a3247d28401b32605aff9510e1ed77db798c Mon Sep 17 00:00:00 2001 From: zkldi <20380519+zkldi@users.noreply.github.com> Date: Mon, 21 Mar 2022 00:21:28 +0000 Subject: [PATCH 5/5] Update to v2.1.8 --- server/package.json | 2 +- server/src/lib/constants/version.ts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/server/package.json b/server/package.json index e2417f6cf..51ba8f90b 100644 --- a/server/package.json +++ b/server/package.json @@ -1,6 +1,6 @@ { "name": "tachi-server", - "version": "2.1.7", + "version": "2.1.8", "description": "A score tracking server.", "main": "js/index.js", "private": true, diff --git a/server/src/lib/constants/version.ts b/server/src/lib/constants/version.ts index d0d611f99..b905797e0 100644 --- a/server/src/lib/constants/version.ts +++ b/server/src/lib/constants/version.ts @@ -4,7 +4,7 @@ const MAJOR = 2; const MINOR = 1; -const PATCH = 7; +const PATCH = 8; // As is with all front-facing zkldi projects, the version names for tachi-server // are from an album I like. In this case, the album is Portishead - Dummy.