QT/bigcapital
1
0
Fork 0
mirror of https://github.com/bigcapitalhq/bigcapital.git synced 2026-02-15 12:20:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: protect the one-click demo accounts endpoints

Browse Source
This commit is contained in:
Ahmed Bouhuolia
2024-08-21 01:04:18 +02:00
parent 4a05ccc692
commit 705b8da053
1 changed files with 21 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
packages/server/src/api/controllers/OneClickDemo/OneClickDemoController.ts
View File

@@ -4,7 +4,7 @@ import { body } from 'express-validator';
import asyncMiddleware from '@/api/middleware/asyncMiddleware';
import BaseController from '@/api/controllers/BaseController';
import { OneClickDemoApplication } from '@/services/OneClickDemo/OneClickDemoApplication';
import config from '@/config';
@Service()
export class OneClickDemoController extends BaseController {
@Inject()
@@ -16,13 +16,29 @@ export class OneClickDemoController extends BaseController {
router() {
const router = Router();
router.post('/one_click', asyncMiddleware(this.oneClickDemo.bind(this)));
// Protects the endpoints if the feature is not enabled.
const protectMiddleware = (
req: Request,
res: Response,
next: NextFunction
) => {
// Add your protection logic here
if (config.oneClickDemoAccounts) {
next();
} else {
res.status(403).send({ message: 'Forbidden' });
}
};
router.post(
'/one_click',
protectMiddleware,
asyncMiddleware(this.oneClickDemo.bind(this))
);
router.post(
'/one_click_signin',
[
body('demo_id').exists(),
],
[body('demo_id').exists()],
this.validationResult,
protectMiddleware,
asyncMiddleware(this.oneClickSignIn.bind(this))
);
return router;