stripe - sanitize - query parameters normalize
MODIFY
src/server/rest/v1/service/BillingService.ts
src/server/rest/v1/service/BillingService.ts
@@ -473,22 +473,21 @@ export default class BillingService {
}
public static async handleBillingSetupPaymentMethod(action: ServerAction, req: Request, res: Response, next: NextFunction): Promise<void> {
- const filteredRequest = BillingSecurity.filterSetupPaymentMethodRequest(req);
// Check if component is active
- UtilsService.assertComponentIsActiveFromToken(filteredRequest.user, TenantComponents.BILLING,
+ UtilsService.assertComponentIsActiveFromToken(req.user, TenantComponents.BILLING,
Action.BILLING_SETUP_PAYMENT_METHOD, Entity.BILLING, MODULE_NAME, 'handleSetupSetupPaymentMethod');
- if (!Authorizations.canCreatePaymentMethod(filteredRequest.user, filteredRequest.currentUserID)) {
+ // Filter
+ const filteredRequest = BillingSecurity.filterSetupPaymentMethodRequest(req.body);
+ if (!Authorizations.canCreatePaymentMethod(req.user, filteredRequest.userID)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
- user: filteredRequest.user,
+ user: req.user,
action: Action.CREATE, entity: Entity.PAYMENT_METHOD,
module: MODULE_NAME, method: 'handleBillingSetupPaymentMethod'
});
}
- // Filter
- // TODO - const filteredRequest = BillingSecurity.filterSynchronizeUserRequest(req.body);
// Get the billing impl
- const billingImpl = await BillingFactory.getBillingImpl(filteredRequest.user.tenantID);
+ const billingImpl = await BillingFactory.getBillingImpl(req.user.tenantID);
if (!billingImpl) {
throw new AppError({
source: Constants.CENTRAL_SERVER,
@@ -496,13 +495,13 @@ export default class BillingService {
message: 'Billing service is not configured',
module: MODULE_NAME, method: 'handleBillingSetupPaymentMethod',
action: action,
- user: filteredRequest.user
+ user: req.user
});
}
- // Get user
- const user: User = await UserStorage.getUser(filteredRequest.user.tenantID, filteredRequest.user.id);
- UtilsService.assertObjectExists(action, user, `User '${filteredRequest.user.id}' does not exist`,
- MODULE_NAME, 'handleSetupPaymentMethod', filteredRequest.user);
+ // Get user - ACHTUNG user !== req.user
+ const user: User = await UserStorage.getUser(req.user.tenantID, filteredRequest.userID);
+ UtilsService.assertObjectExists(action, user, `User '${filteredRequest.userID}' does not exist`,
+ MODULE_NAME, 'handleSetupPaymentMethod', req.user);
// Invoke the billing implementation
const paymentMethodId: string = filteredRequest.paymentMethodId;
const operationResult: BillingOperationResult = await billingImpl.setupPaymentMethod(user, paymentMethodId);
@@ -515,20 +514,20 @@ export default class BillingService {
public static async handleBillingGetPaymentMethods(action: ServerAction, req: Request, res: Response, next: NextFunction): Promise<void> {
// Filter
- const filteredRequest = BillingSecurity.filterPaymentMethodsRequest(req);
+ const filteredRequest = BillingSecurity.filterPaymentMethodsRequest(req.query);
// Check if component is active
- UtilsService.assertComponentIsActiveFromToken(filteredRequest.loggedUser, TenantComponents.BILLING,
+ UtilsService.assertComponentIsActiveFromToken(req.user, TenantComponents.BILLING,
Action.BILLING_PAYMENT_METHODS, Entity.BILLING, MODULE_NAME, 'handleBillingGetPaymentMethods');
- if (!Authorizations.canListPaymentMethod(filteredRequest.loggedUser)) {
+ if (!Authorizations.canListPaymentMethod(req.user)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
- user: filteredRequest.loggedUser,
+ user: req.user,
action: Action.CREATE, entity: Entity.PAYMENT_METHOD,
module: MODULE_NAME, method: 'handleBillingGetPaymentMethods'
});
}
// Get the billing impl
- const billingImpl = await BillingFactory.getBillingImpl(filteredRequest.loggedUser.tenantID);
+ const billingImpl = await BillingFactory.getBillingImpl(req.user.tenantID);
if (!billingImpl) {
throw new AppError({
source: Constants.CENTRAL_SERVER,
@@ -536,13 +535,13 @@ export default class BillingService {
message: 'Billing service is not configured',
module: MODULE_NAME, method: 'handleBillingGetPaymentMethods',
action: action,
- user: filteredRequest.loggedUser
+ user: req.user
});
}
- // Get user
- const user: User = await UserStorage.getUser(filteredRequest.loggedUser.tenantID, filteredRequest.selectedUserID);
- UtilsService.assertObjectExists(action, user, `User '${filteredRequest.selectedUserID}' does not exist`,
- MODULE_NAME, 'handleBillingGetPaymentMethods', filteredRequest.loggedUser);
+ // Get user - ACHTUNG user !== req.user
+ const user: User = await UserStorage.getUser(req.user.tenantID, filteredRequest.userID);
+ UtilsService.assertObjectExists(action, user, `User '${filteredRequest.userID}' does not exist`,
+ MODULE_NAME, 'handleBillingGetPaymentMethods', req.user);
// Invoke the billing implementation
const paymentMethodResult: BillingPaymentMethodResult = await billingImpl.getPaymentMethods(user);
if (paymentMethodResult) {
@@ -554,20 +553,20 @@ export default class BillingService {
public static async handleBillingDeletePaymentMethod(action: ServerAction, req: Request, res: Response, next: NextFunction): Promise<void> {
// Filter
- const filteredRequest = BillingSecurity.filterDeletePaymentMethodRequest(req);
+ const filteredRequest = BillingSecurity.filterDeletePaymentMethodRequest(req.body);
// Check if component is active
- UtilsService.assertComponentIsActiveFromToken(filteredRequest.loggedUser, TenantComponents.BILLING,
+ UtilsService.assertComponentIsActiveFromToken(req.user, TenantComponents.BILLING,
Action.BILLING_PAYMENT_METHODS, Entity.BILLING, MODULE_NAME, 'handleBillingDeletePaymentMethod');
- if (!Authorizations.canDeletePaymentMethod(filteredRequest.loggedUser)) {
+ if (!Authorizations.canDeletePaymentMethod(req.user)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
- user: filteredRequest.loggedUser,
+ user: req.user,
action: Action.CREATE, entity: Entity.PAYMENT_METHOD,
module: MODULE_NAME, method: 'handleBillingDeletePaymentMethod'
});
}
// Get the billing impl
- const billingImpl = await BillingFactory.getBillingImpl(filteredRequest.loggedUser.tenantID);
+ const billingImpl = await BillingFactory.getBillingImpl(req.user.tenantID);
if (!billingImpl) {
throw new AppError({
source: Constants.CENTRAL_SERVER,
@@ -575,13 +574,13 @@ export default class BillingService {
message: 'Billing service is not configured',
module: MODULE_NAME, method: 'handleBillingDeletePaymentMethod',
action: action,
- user: filteredRequest.loggedUser
+ user: req.user
});
}
- // Get user
- const user: User = await UserStorage.getUser(filteredRequest.loggedUser.tenantID, filteredRequest.loggedUser.id);
- UtilsService.assertObjectExists(action, user, `User '${filteredRequest.loggedUser.id}' does not exist`,
- MODULE_NAME, 'handleBillingDeletePaymentMethod', filteredRequest.loggedUser);
+ // Get user - ACHTUNG user !== req.user
+ const user: User = await UserStorage.getUser(req.user.tenantID, filteredRequest.userID);
+ UtilsService.assertObjectExists(action, user, `User '${filteredRequest.userID}' does not exist`,
+ MODULE_NAME, 'handleBillingDeletePaymentMethod', req.user);
// Invoke the billing implementation
const paymentMethodResult: BillingPaymentMethodResult = await billingImpl.deletePaymentMethod(user, filteredRequest.paymentMethodId);
if (paymentMethodResult) {

MODIFY
src/server/rest/v1/service/security/BillingSecurity.ts
src/server/rest/v1/service/security/BillingSecurity.ts
@@ -7,60 +7,54 @@ import UtilsSecurity from './UtilsSecurity';
import sanitize from 'mongo-sanitize';
export default class BillingSecurity {
- static filterSynchronizeUserRequest(request: any): HttpSynchronizeUserRequest {
+ static filterSynchronizeUserRequest(requestBody: any): HttpSynchronizeUserRequest {
const filteredUser: HttpSynchronizeUserRequest = {} as HttpSynchronizeUserRequest;
- if (Utils.objectHasProperty(request, 'id')) {
- filteredUser.id = sanitize(request.id);
+ if (Utils.objectHasProperty(requestBody, 'id')) {
+ filteredUser.id = sanitize(requestBody.id);
}
- if (Utils.objectHasProperty(request, 'email')) {
- filteredUser.email = sanitize(request.email);
+ if (Utils.objectHasProperty(requestBody, 'email')) {
+ filteredUser.email = sanitize(requestBody.email);
}
return filteredUser;
}
- static filterGetUserInvoicesRequest(request: any): HttpBillingInvoiceRequest {
+ static filterGetUserInvoicesRequest(requestQuery: any): HttpBillingInvoiceRequest {
const filteredRequest = {} as HttpBillingInvoiceRequest;
- if (Utils.objectHasProperty(request, 'UserID')) {
- filteredRequest.UserID = sanitize(request.UserID);
+ if (Utils.objectHasProperty(requestQuery, 'UserID')) {
+ filteredRequest.UserID = sanitize(requestQuery.UserID);
}
- if (Utils.objectHasProperty(request, 'Status')) {
- filteredRequest.Status = sanitize(request.Status);
+ if (Utils.objectHasProperty(requestQuery, 'Status')) {
+ filteredRequest.Status = sanitize(requestQuery.Status);
}
- if (Utils.objectHasProperty(request, 'StartDateTime')) {
- filteredRequest.StartDateTime = sanitize(request.StartDateTime);
+ if (Utils.objectHasProperty(requestQuery, 'StartDateTime')) {
+ filteredRequest.StartDateTime = sanitize(requestQuery.StartDateTime);
}
- if (Utils.objectHasProperty(request, 'EndDateTime')) {
- filteredRequest.EndDateTime = sanitize(request.EndDateTime);
+ if (Utils.objectHasProperty(requestQuery, 'EndDateTime')) {
+ filteredRequest.EndDateTime = sanitize(requestQuery.EndDateTime);
}
- if (Utils.objectHasProperty(request, 'Search')) {
- filteredRequest.Search = sanitize(request.Search);
+ if (Utils.objectHasProperty(requestQuery, 'Search')) {
+ filteredRequest.Search = sanitize(requestQuery.Search);
}
- UtilsSecurity.filterSkipAndLimit(request, filteredRequest);
- UtilsSecurity.filterSort(request, filteredRequest);
+ UtilsSecurity.filterSkipAndLimit(requestQuery, filteredRequest);
+ UtilsSecurity.filterSort(requestQuery, filteredRequest);
return filteredRequest;
}
- static filterForceSynchronizeUserInvoicesRequest(request: any): HttpForceSynchronizeUserInvoicesRequest {
+ static filterForceSynchronizeUserInvoicesRequest(requestBody: any): HttpForceSynchronizeUserInvoicesRequest {
return {
- userID: sanitize(request.userID)
+ userID: sanitize(requestBody.userID)
};
}
- static filterLinkTransactionToInvoiceRequest(request: any): HttpCreateTransactionInvoiceRequest {
+ static filterLinkTransactionToInvoiceRequest(requestBody: any): HttpCreateTransactionInvoiceRequest {
return {
- transactionID: sanitize(request.transactionID)
+ transactionID: sanitize(requestBody.transactionID)
};
}
- static filterDownloadInvoiceRequest(request: any): HttpByIDRequest {
+ static filterDownloadInvoiceRequest(requestQuery: any): HttpByIDRequest {
return {
- ID: sanitize(request.ID)
- };
- }
-
- static filterChargeInvoiceRequest(request: any): HttpByIDRequest {
- return {
- ID: sanitize(request.ID)
+ ID: sanitize(requestQuery.ID)
};
}
@@ -70,28 +64,25 @@ export default class BillingSecurity {
};
}
- static filterSetupPaymentMethodRequest(request: any): HttpSetupPaymentMethod {
+ static filterSetupPaymentMethodRequest(requestBody: any): HttpSetupPaymentMethod {
return {
- user: sanitize(request.user),
- currentUserID: sanitize(request.body.userID),
- paymentMethodId: sanitize(request.body.paymentMethodId),
+ userID: sanitize(requestBody.userID),
+ paymentMethodId: sanitize(requestBody.paymentMethodId),
};
}
- static filterPaymentMethodsRequest(request: any): HttpPaymentMethods {
+ static filterPaymentMethodsRequest(requestQuery: any): HttpPaymentMethods {
const filteredRequest: HttpPaymentMethods = {
- loggedUser: sanitize(request.user),
- selectedUserID: sanitize(request.query.userID)
+ userID: sanitize(requestQuery.userID)
};
- UtilsSecurity.filterSkipAndLimit(request.query, filteredRequest);
+ UtilsSecurity.filterSkipAndLimit(requestQuery, filteredRequest);
return filteredRequest;
}
- // should add currentuserid to check canDeletePm() ??
- static filterDeletePaymentMethodRequest(request: any): HttpDeletePaymentMethod {
+ static filterDeletePaymentMethodRequest(requestBody: any): HttpDeletePaymentMethod {
return {
- loggedUser: sanitize(request.user),
- paymentMethodId: sanitize(request.body.paymentMethodId),
+ userID: sanitize(requestBody.userID),
+ paymentMethodId: sanitize(requestBody.paymentMethodId),
};
}
}

MODIFY
src/types/requests/HttpBillingRequest.ts
src/types/requests/HttpBillingRequest.ts
@@ -19,17 +19,15 @@ export interface HttpBillingWebHookRequest {
}
export interface HttpSetupPaymentMethod {
- user: UserToken;
- currentUserID: string;
+ userID: string;
paymentMethodId?: string;
}
export interface HttpPaymentMethods {
- loggedUser: UserToken;
- selectedUserID: string;
+ userID: string;
}
export interface HttpDeletePaymentMethod {
- loggedUser: UserToken;
+ userID: string;
paymentMethodId: string;
}

stripe - sanitize - query parameters normalize