mirror of
https://github.com/Portabase/portabase.git
synced 2026-07-14 11:16:13 +02:00
Four missed cases where deleted/archived resources could leak through: - acl.ts: exclude deleted databases from getAccessibleDatabaseIds - databases/route.ts: exclude deleted databases in list endpoint - agents/route.ts: re-apply isArchived guard on final fetch (ACL ids stale) - databases/[id]/status/route.ts: exclude deleted restorations
58 lines
2.0 KiB
TypeScript
58 lines
2.0 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { withApiKey, ApiKeyContext } from "@/lib/api-v1/middleware";
|
|
import { getAccessibleDatabaseIds } from "@/lib/api-v1/acl";
|
|
import { db } from "@/db";
|
|
import * as drizzleDb from "@/db";
|
|
import { eq, desc, and, isNull } from "drizzle-orm";
|
|
import { logger } from "@/lib/logger";
|
|
|
|
const log = logger.child({ module: "api/v1/databases/[id]/status" });
|
|
|
|
export const GET = withApiKey(
|
|
async (_req: Request, ctx: ApiKeyContext, params?: Record<string, string>) => {
|
|
try {
|
|
const id = params?.id;
|
|
if (!id) return NextResponse.json({ error: "Not found" }, { status: 404 });
|
|
|
|
const accessibleIds = await getAccessibleDatabaseIds(ctx.userId);
|
|
if (!accessibleIds.includes(id)) {
|
|
const exists = await db.query.database.findFirst({
|
|
where: eq(drizzleDb.schemas.database.id, id),
|
|
columns: { id: true },
|
|
});
|
|
return NextResponse.json(
|
|
{ error: exists ? "Forbidden" : "Not found" },
|
|
{ status: exists ? 403 : 404 }
|
|
);
|
|
}
|
|
|
|
const [latestBackup, latestRestoration] = await Promise.all([
|
|
db.query.backup.findFirst({
|
|
where: and(
|
|
eq(drizzleDb.schemas.backup.databaseId, id),
|
|
isNull(drizzleDb.schemas.backup.deletedAt)
|
|
),
|
|
orderBy: [desc(drizzleDb.schemas.backup.createdAt)],
|
|
}),
|
|
db.query.restoration.findFirst({
|
|
where: and(
|
|
eq(drizzleDb.schemas.restoration.databaseId, id),
|
|
isNull(drizzleDb.schemas.restoration.deletedAt)
|
|
),
|
|
orderBy: [desc(drizzleDb.schemas.restoration.createdAt)],
|
|
}),
|
|
]);
|
|
|
|
return NextResponse.json({
|
|
data: {
|
|
latestBackup: latestBackup ?? null,
|
|
latestRestoration: latestRestoration ?? null,
|
|
},
|
|
});
|
|
} catch (error) {
|
|
log.error({ error }, "Error in GET /api/v1/databases/[id]/status");
|
|
return NextResponse.json({ error: "Internal server error" }, { status: 500 });
|
|
}
|
|
}
|
|
);
|