mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-02-13 13:04:24 +01:00
b8c31e7314
* 🔧 feat: Update user key handling in keys route and add comprehensive tests - Enhanced the PUT /api/keys route to destructure request body for better clarity and maintainability. - Introduced a new test suite for keys route, covering key update, deletion, and retrieval functionalities, ensuring robust validation and IDOR prevention. - Added tests to verify handling of extraneous fields and missing optional parameters in requests. * 🔧 fix: Enhance conversation deletion route with parameter validation - Updated the DELETE /api/convos route to handle cases where the request body is empty or the 'arg' parameter is null/undefined, returning a 400 status with an appropriate error message for DoS prevention. - Added corresponding tests to ensure proper validation and error handling for these scenarios, enhancing the robustness of the API. * 🔧 fix: Improve request body validation in keys and convos routes - Updated the DELETE /api/convos and PUT /api/keys routes to validate the request body, returning a 400 status for null or invalid bodies to enhance security and prevent potential DoS attacks. - Added corresponding tests to ensure proper error handling for these scenarios, improving the robustness of the API.
40 lines
1.2 KiB
JavaScript
40 lines
1.2 KiB
JavaScript
const express = require('express');
|
|
const { updateUserKey, deleteUserKey, getUserKeyExpiry } = require('~/models');
|
|
const { requireJwtAuth } = require('~/server/middleware');
|
|
|
|
const router = express.Router();
|
|
|
|
router.put('/', requireJwtAuth, async (req, res) => {
|
|
if (req.body == null || typeof req.body !== 'object') {
|
|
return res.status(400).send({ error: 'Invalid request body.' });
|
|
}
|
|
const { name, value, expiresAt } = req.body;
|
|
await updateUserKey({ userId: req.user.id, name, value, expiresAt });
|
|
res.status(201).send();
|
|
});
|
|
|
|
router.delete('/:name', requireJwtAuth, async (req, res) => {
|
|
const { name } = req.params;
|
|
await deleteUserKey({ userId: req.user.id, name });
|
|
res.status(204).send();
|
|
});
|
|
|
|
router.delete('/', requireJwtAuth, async (req, res) => {
|
|
const { all } = req.query;
|
|
|
|
if (all !== 'true') {
|
|
return res.status(400).send({ error: 'Specify either all=true to delete.' });
|
|
}
|
|
|
|
await deleteUserKey({ userId: req.user.id, all: true });
|
|
|
|
res.status(204).send();
|
|
});
|
|
|
|
router.get('/', requireJwtAuth, async (req, res) => {
|
|
const { name } = req.query;
|
|
const response = await getUserKeyExpiry({ userId: req.user.id, name });
|
|
res.status(200).send(response);
|
|
});
|
|
|
|
module.exports = router;
|