openhands
7ad66fdc16
Local Build and Deploy / deploy (push) Successful in 1m2s
- Create src/lib/foundation/ (860 LOC, 9 files): typed action wrappers, DbService with health checks, CSRF validation, safe redirects, AsyncLocalStorage request tracing, branded types, reusable Zod schemas - Migrate moderation.ts and user-settings.ts to foundation patterns - Fix abuse-guard.ts: bound in-memory Maps with LRU eviction (was unbounded) - Fix access-guard.ts: separate try/catch per check, log degradation instead of blanket fail-open - Replace raw redirect() calls with safeRedirect() in guard.ts and permissions.ts to prevent open-redirect attacks - Add CSRF validation to api-handler.ts for mutating methods - Add canonicalizeFormData() utility for FormData input sanitization
26 lines
923 B
TypeScript
26 lines
923 B
TypeScript
import { isStaff } from "@/lib/admin/is-staff";
|
|
import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
|
|
import { clientIp, rateLimit } from "@/lib/rate-limit";
|
|
import { redirectSafe } from "@/lib/foundation/security";
|
|
|
|
export { isStaff };
|
|
|
|
export interface StaffUser {
|
|
id: number;
|
|
rank: number;
|
|
username: string;
|
|
}
|
|
|
|
export async function requireStaff(): Promise<StaffUser> {
|
|
const { session, permissions } = await getAdminContext();
|
|
if (!canAccess(permissions, PERMS.ADMIN_DASHBOARD, session.user.rank)) redirectSafe("/", "/");
|
|
return { id: session.user.id, rank: session.user.rank, username: session.user.username };
|
|
}
|
|
|
|
export async function requireStaffRateLimited(): Promise<StaffUser> {
|
|
const staff = await requireStaff();
|
|
const ip = await clientIp();
|
|
if (!(await rateLimit(`admin:${staff.id}:${ip}`, 30, 60_000)).ok) redirectSafe("/admin?error=ratelimit", "/admin");
|
|
return staff;
|
|
}
|