Merge branch 'proper-auth' into 'dev'

feat: Properly authenticate and prevent access of /api

See merge request cse2000-software-project/2023-2024/cluster-n/11c/atypical-speech-project!153

.gitlab-ci.yml

@@ -19,6 +19,8 @@ stages:
 build:app:
   stage: build
   image: 'node:22.1.0-slim'
+  variables:
+    PUBLIC_KERNEL_ORIGIN: "http://kernel:8000"
   rules:
     - changes:
         - app/**/*
@@ -35,6 +37,8 @@ build:app:
 typecheck:app:
   stage: typecheck
   image: 'node:22.1.0-slim'
+  variables:
+    PUBLIC_KERNEL_ORIGIN: "http://kernel:8000"
   rules:
     - changes:
         - app/**/*
@@ -52,6 +56,8 @@ typecheck:app:
 lint:app:
   stage: lint
   image: 'node:22.1.0-slim'
+  variables:
+    PUBLIC_KERNEL_ORIGIN: "http://kernel:8000"
   rules:
     - changes:
         - app/**/*
@@ -69,6 +75,8 @@ lint:app:
 test:app:
   stage: test
   image: 'node:22.1.0-slim'
+  variables:
+    PUBLIC_KERNEL_ORIGIN: "http://kernel:8000"
   rules:
     - changes:
         - app/**/*

app/src/lib/analysis/modes/transcription/Track.svelte

@@ -97,9 +97,9 @@
 						tabindex="0"
 						class="flex h-full w-full items-center justify-center overflow-clip rounded-none bg-accent text-accent-foreground"
 						onclick={(event: MouseEvent) => handleCreate(event, caption)}
-						ondblclick={(event: MouseEvent)=>{
-							doubleClick(event)
-							createRegion(caption.start, caption.end, null)
+						ondblclick={(event: MouseEvent) => {
+							doubleClick(event);
+							createRegion(caption.start, caption.end, null);
 						}}
 						onfocusout={(event: FocusEvent) => focusOut(event, caption)}
 						onkeydown={(event: KeyboardEvent) => keyDown(event, caption)}

app/src/routes/(protected)/api/[...path]/+server.ts

@@ -0,0 +1,49 @@
+import { PUBLIC_KERNEL_ORIGIN } from '$env/static/public';
+import { error } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { z } from 'zod';
+import { db } from '$lib/database';
+import { and, eq } from 'drizzle-orm';
+import { fileTable } from '$lib/database/schema';
+
+export const POST: RequestHandler = async ({ request, params: { path }, locals: { user } }) => {
+	if (!user) {
+		error(401, 'Not logged in');
+	}
+
+	const json = (await request.json()) as unknown;
+
+	const jsonShape = z.object({
+		fileState: z.object({
+			id: z.string()
+		})
+	});
+
+	const result = jsonShape.safeParse(json);
+
+	if (!result.success) {
+		error(400, 'Invalid JSON or no fileState.id');
+	}
+
+	const {
+		fileState: { id }
+	} = result.data;
+
+	const dbFile = await db.query.fileTable.findFirst({
+		where: and(eq(fileTable.id, id), eq(fileTable.uploader, user.id)),
+		columns: { id: true }
+	});
+
+	if (!dbFile) {
+		error(404, `File not found (id: ${id})`);
+	}
+
+	const url = new URL(path, PUBLIC_KERNEL_ORIGIN);
+	return await fetch(url, {
+		method: 'POST',
+		headers: {
+			'Content-Type': 'application/json'
+		},
+		body: JSON.stringify(json)
+	});
+};

app/src/routes/(protected)/recorder/RecorderSingle.svelte

@@ -137,7 +137,11 @@
 						on:focus={disableShortcuts}
 						on:blur={enableShortcuts}
 						bind:value={previewing.note}
-						on:input={(e: InputEvent) => {if(previewingIndex){handleNoteChange(e, previewingIndex)}}}
+						on:input={(e: InputEvent) => {
+							if (previewingIndex) {
+								handleNoteChange(e, previewingIndex);
+							}
+						}}
 					/>
 				{/if}
 			</div>

docker-compose.prod.yaml

@@ -28,7 +28,7 @@ services:
     restart: unless-stopped
     stop_grace_period: 5s
     environment:
-      PUBLIC_KERNEL_ORIGIN: http://kernel
+      PUBLIC_KERNEL_ORIGIN: http://kernel:8000
       PG_CONNECTION_STRING: postgres://user:password@postgres:5432/spectral_db
     build:
       context: ./app

docker-compose.yaml

@@ -28,7 +28,7 @@ services:
     restart: unless-stopped
     stop_grace_period: 500ms
     environment:
-      PUBLIC_KERNEL_ORIGIN: http://kernel
+      PUBLIC_KERNEL_ORIGIN: http://kernel:8000
       PG_CONNECTION_STRING: postgres://user:password@postgres:5432/spectral_db
     build:
       context: ./app

nginx.conf

@@ -22,16 +22,6 @@ http {
             client_max_body_size 100M; # Allows file uploads up to 100MB
         }
 
-        # Configuration for the kernel service
-        location /api/ {
-            proxy_pass http://kernel:8000; # Proxies requests to the kernel service
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection 'upgrade';
-            proxy_set_header Host $host;
-            proxy_cache_bypass $http_upgrade;
-        }
-
         location ^~ /log/ {
             proxy_pass http://log:8080;
 

nginx.prod.conf

@@ -41,16 +41,6 @@ http {
             client_max_body_size 2G; # Allows file uploads up to 2G
         }
 
-        # Configuration for the kernel service
-        location /api/ {
-            proxy_pass http://kernel:8000; # Proxies requests to the kernel service
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection 'upgrade';
-            proxy_set_header Host $host;
-            proxy_cache_bypass $http_upgrade;
-        }
-
         # Configuration for the log service
         location ^~ /log/ {
             proxy_pass http://log:8080;