Files
library/api/src/app/services/show.service.ts
T
hikari 6d5b0581a5
Node.js CI / CI (push) Has been cancelled
Security Scan and Upload / Security & DefectDojo Upload (push) Has been cancelled
fix: base64 uploads, audit log noise, and stale chunk reloads (#69)
## Summary

- **Base64 cover image uploads broken for books, shows, manga, and music** — a premature `validateStringLength` check ran before the data URL detection, rejecting all base64 images with a 2,048-char URL limit error. Also fixed the size calculation to extract only the base64 portion after the comma (matching the correct pattern already in `game.service.ts`).
- **Audit log flooded with expected 401s on `/api/auth/me`** — these occur during normal token refresh flow and are not genuine security events. Excluded this URL from the global 401/403 audit log handler.
- **ChunkLoadError spam after deployments** — when Angular lazy-loaded chunks are missing (stale cache after a redeploy), the global error handler now detects `ChunkLoadError` and silently reloads the page instead of logging the error and sending it to the API/Discord.

## Test plan

- [ ] Upload a base64 cover image for a book, show, manga, and music item — should succeed
- [ ] Verify `/api/auth/me` 401s no longer appear in the audit log
- [ ] Deploy a new build and confirm stale-chunk users are silently reloaded

 This PR was created with help from Hikari~ 🌸

Reviewed-on: #69
Co-authored-by: Hikari <hikari@nhcarrigan.com>
Co-committed-by: Hikari <hikari@nhcarrigan.com>
2026-02-23 20:37:52 -08:00

194 lines
5.7 KiB
TypeScript

/**
* @copyright 2026 NHCarrigan
* @license Naomi's Public License
* @author Naomi Carrigan
*/
import { Show, ShowStatus, ShowType, CreateShowDto, UpdateShowDto } from "@library/shared-types";
import { prisma } from "../lib/prisma";
import {
validateUrl,
validateRating,
validateStringLength,
validateDataUrl,
MAX_LENGTHS,
} from "../utils/validation";
export class ShowService {
private prisma = prisma;
constructor() {}
/**
* Validate show data for security.
*/
private validateShowData(data: CreateShowDto | UpdateShowDto): void {
// Validate string lengths
if (!validateStringLength(data.title, MAX_LENGTHS.TITLE)) {
throw new Error(`Title must be ${MAX_LENGTHS.TITLE} characters or less.`);
}
if (!validateStringLength(data.notes, MAX_LENGTHS.NOTES)) {
throw new Error(`Notes must be ${MAX_LENGTHS.NOTES} characters or less.`);
}
// Validate rating
if (!validateRating(data.rating)) {
throw new Error("Rating must be an integer between 0 and 10.");
}
// Validate cover image URL
if (data.coverImage) {
if (data.coverImage.startsWith("data:")) {
const base64Data = data.coverImage.split(",")[1];
if (!base64Data) {
throw new Error("Invalid image data URL format.");
}
const sizeInBytes = base64Data.length * 0.75;
if (sizeInBytes > MAX_LENGTHS.DATA_URL) {
throw new Error("Cover image must be under 5MB.");
}
if (!validateDataUrl(data.coverImage)) {
throw new Error("Invalid image data URL.");
}
} else {
if (!validateStringLength(data.coverImage, MAX_LENGTHS.URL)) {
throw new Error(`Cover image URL must be ${MAX_LENGTHS.URL} characters or less.`);
}
if (!validateUrl(data.coverImage)) {
throw new Error("Invalid cover image URL. Only http and https URLs are allowed.");
}
}
}
// Validate tags
if (data.tags) {
for (const tag of data.tags) {
if (!validateStringLength(tag, MAX_LENGTHS.TAGS)) {
throw new Error(`Each tag must be ${MAX_LENGTHS.TAGS} characters or less.`);
}
}
}
// Validate link URLs
if (data.links) {
for (const link of data.links) {
if (!validateUrl(link.url)) {
throw new Error(`Invalid link URL: ${link.title}. Only http and https URLs are allowed.`);
}
if (!validateStringLength(link.title, MAX_LENGTHS.TITLE)) {
throw new Error(`Link title must be ${MAX_LENGTHS.TITLE} characters or less.`);
}
if (!validateStringLength(link.url, MAX_LENGTHS.URL)) {
throw new Error(`Link URL must be ${MAX_LENGTHS.URL} characters or less.`);
}
}
}
}
async getAllShows(): Promise<Show[]> {
const shows = await this.prisma.show.findMany({
orderBy: { updatedAt: "desc" },
});
return shows.map((show) => ({
...show,
type: show.type as unknown as ShowType,
status: show.status as unknown as ShowStatus,
dateAdded: show.dateAdded,
dateStarted: show.dateStarted || undefined,
dateCompleted: show.dateCompleted || undefined,
dateFinished: show.dateFinished || undefined,
tags: show.tags ?? [],
links: show.links ?? [],
createdAt: show.createdAt,
updatedAt: show.updatedAt,
}));
}
async getShowById(id: string): Promise<Show | null> {
const show = await this.prisma.show.findUnique({
where: { id },
});
if (!show) return null;
return {
...show,
type: show.type as unknown as ShowType,
status: show.status as unknown as ShowStatus,
dateAdded: show.dateAdded,
dateStarted: show.dateStarted || undefined,
dateCompleted: show.dateCompleted || undefined,
dateFinished: show.dateFinished || undefined,
tags: show.tags ?? [],
links: show.links ?? [],
createdAt: show.createdAt,
updatedAt: show.updatedAt,
};
}
async createShow(data: CreateShowDto): Promise<Show> {
// Validate input
this.validateShowData(data);
const show = await this.prisma.show.create({
data: {
...data,
type: data.type.toUpperCase() as any,
status: data.status.toUpperCase() as any,
},
});
return {
...show,
type: show.type as unknown as ShowType,
status: show.status as unknown as ShowStatus,
dateAdded: show.dateAdded,
dateStarted: show.dateStarted || undefined,
dateCompleted: show.dateCompleted || undefined,
dateFinished: show.dateFinished || undefined,
tags: show.tags ?? [],
links: show.links ?? [],
createdAt: show.createdAt,
updatedAt: show.updatedAt,
};
}
async updateShow(id: string, data: UpdateShowDto): Promise<Show> {
// Validate input
this.validateShowData(data);
const updateData = { ...data };
if (updateData.type) {
updateData.type = updateData.type.toUpperCase() as any;
}
if (updateData.status) {
updateData.status = updateData.status.toUpperCase() as any;
}
const show = await this.prisma.show.update({
where: { id },
data: updateData,
});
return {
...show,
type: show.type as unknown as ShowType,
status: show.status as unknown as ShowStatus,
dateAdded: show.dateAdded,
dateStarted: show.dateStarted || undefined,
dateCompleted: show.dateCompleted || undefined,
dateFinished: show.dateFinished || undefined,
tags: show.tags ?? [],
links: show.links ?? [],
createdAt: show.createdAt,
updatedAt: show.updatedAt,
};
}
async deleteShow(id: string): Promise<void> {
await this.prisma.show.delete({
where: { id },
});
}
}