generated from nhcarrigan/template
6d5b0581a5
## Summary - **Base64 cover image uploads broken for books, shows, manga, and music** — a premature `validateStringLength` check ran before the data URL detection, rejecting all base64 images with a 2,048-char URL limit error. Also fixed the size calculation to extract only the base64 portion after the comma (matching the correct pattern already in `game.service.ts`). - **Audit log flooded with expected 401s on `/api/auth/me`** — these occur during normal token refresh flow and are not genuine security events. Excluded this URL from the global 401/403 audit log handler. - **ChunkLoadError spam after deployments** — when Angular lazy-loaded chunks are missing (stale cache after a redeploy), the global error handler now detects `ChunkLoadError` and silently reloads the page instead of logging the error and sending it to the API/Discord. ## Test plan - [ ] Upload a base64 cover image for a book, show, manga, and music item — should succeed - [ ] Verify `/api/auth/me` 401s no longer appear in the audit log - [ ] Deploy a new build and confirm stale-chunk users are silently reloaded ✨ This PR was created with help from Hikari~ 🌸 Reviewed-on: #69 Co-authored-by: Hikari <hikari@nhcarrigan.com> Co-committed-by: Hikari <hikari@nhcarrigan.com>
211 lines
6.1 KiB
TypeScript
211 lines
6.1 KiB
TypeScript
/**
|
|
* @copyright 2026 NHCarrigan
|
|
* @license Naomi's Public License
|
|
* @author Naomi Carrigan
|
|
*/
|
|
|
|
import { Music, MusicStatus, MusicType, CreateMusicDto, UpdateMusicDto } from "@library/shared-types";
|
|
import { prisma } from "../lib/prisma";
|
|
import {
|
|
validateUrl,
|
|
validateRating,
|
|
validateStringLength,
|
|
validateDataUrl,
|
|
MAX_LENGTHS,
|
|
} from "../utils/validation";
|
|
|
|
export class MusicService {
|
|
private prisma = prisma;
|
|
|
|
constructor() {}
|
|
|
|
/**
|
|
* Validate music data for security.
|
|
*/
|
|
private validateMusicData(data: CreateMusicDto | UpdateMusicDto): void {
|
|
// Validate string lengths
|
|
if (!validateStringLength(data.title, MAX_LENGTHS.TITLE)) {
|
|
throw new Error(`Title must be ${MAX_LENGTHS.TITLE} characters or less.`);
|
|
}
|
|
if (!validateStringLength(data.artist, MAX_LENGTHS.AUTHOR)) {
|
|
throw new Error(`Artist must be ${MAX_LENGTHS.AUTHOR} characters or less.`);
|
|
}
|
|
if (!validateStringLength(data.notes, MAX_LENGTHS.NOTES)) {
|
|
throw new Error(`Notes must be ${MAX_LENGTHS.NOTES} characters or less.`);
|
|
}
|
|
// Validate rating
|
|
if (data.rating !== undefined && !validateRating(data.rating)) {
|
|
throw new Error("Rating must be an integer between 0 and 10.");
|
|
}
|
|
|
|
// Validate cover art URL
|
|
if (data.coverArt) {
|
|
if (data.coverArt.startsWith("data:")) {
|
|
const base64Data = data.coverArt.split(",")[1];
|
|
if (!base64Data) {
|
|
throw new Error("Invalid image data URL format.");
|
|
}
|
|
const sizeInBytes = base64Data.length * 0.75;
|
|
if (sizeInBytes > MAX_LENGTHS.DATA_URL) {
|
|
throw new Error("Cover image must be under 5MB.");
|
|
}
|
|
if (!validateDataUrl(data.coverArt)) {
|
|
throw new Error("Invalid image data URL.");
|
|
}
|
|
} else {
|
|
if (!validateStringLength(data.coverArt, MAX_LENGTHS.URL)) {
|
|
throw new Error(`Cover image URL must be ${MAX_LENGTHS.URL} characters or less.`);
|
|
}
|
|
if (!validateUrl(data.coverArt)) {
|
|
throw new Error("Invalid cover image URL. Only http and https URLs are allowed.");
|
|
}
|
|
}
|
|
}
|
|
|
|
// Validate tags
|
|
if (data.tags) {
|
|
for (const tag of data.tags) {
|
|
if (!validateStringLength(tag, MAX_LENGTHS.TAGS)) {
|
|
throw new Error(`Each tag must be ${MAX_LENGTHS.TAGS} characters or less.`);
|
|
}
|
|
}
|
|
}
|
|
|
|
// Validate link URLs
|
|
if (data.links) {
|
|
for (const link of data.links) {
|
|
if (!validateUrl(link.url)) {
|
|
throw new Error(`Invalid link URL: ${link.title}. Only http and https URLs are allowed.`);
|
|
}
|
|
if (!validateStringLength(link.title, MAX_LENGTHS.TITLE)) {
|
|
throw new Error(`Link title must be ${MAX_LENGTHS.TITLE} characters or less.`);
|
|
}
|
|
if (!validateStringLength(link.url, MAX_LENGTHS.URL)) {
|
|
throw new Error(`Link URL must be ${MAX_LENGTHS.URL} characters or less.`);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get all music.
|
|
*/
|
|
async getAllMusic(): Promise<Music[]> {
|
|
const musicItems = await this.prisma.music.findMany({
|
|
orderBy: { updatedAt: "desc" },
|
|
});
|
|
|
|
return musicItems.map((music) => ({
|
|
...music,
|
|
type: music.type as unknown as MusicType,
|
|
status: music.status as unknown as MusicStatus,
|
|
dateAdded: music.dateAdded,
|
|
dateStarted: music.dateStarted || undefined,
|
|
dateCompleted: music.dateCompleted || undefined,
|
|
dateFinished: music.dateFinished || undefined,
|
|
tags: music.tags ?? [],
|
|
links: music.links ?? [],
|
|
createdAt: music.createdAt,
|
|
updatedAt: music.updatedAt,
|
|
}));
|
|
}
|
|
|
|
/**
|
|
* Get music by ID.
|
|
*/
|
|
async getMusicById(id: string): Promise<Music | null> {
|
|
const music = await this.prisma.music.findUnique({
|
|
where: { id },
|
|
});
|
|
|
|
if (!music) return null;
|
|
|
|
return {
|
|
...music,
|
|
type: music.type as unknown as MusicType,
|
|
status: music.status as unknown as MusicStatus,
|
|
dateAdded: music.dateAdded,
|
|
dateStarted: music.dateStarted || undefined,
|
|
dateCompleted: music.dateCompleted || undefined,
|
|
dateFinished: music.dateFinished || undefined,
|
|
tags: music.tags ?? [],
|
|
links: music.links ?? [],
|
|
createdAt: music.createdAt,
|
|
updatedAt: music.updatedAt,
|
|
};
|
|
}
|
|
|
|
/**
|
|
* Create new music.
|
|
*/
|
|
async createMusic(data: CreateMusicDto): Promise<Music> {
|
|
// Validate input
|
|
this.validateMusicData(data);
|
|
|
|
const music = await this.prisma.music.create({
|
|
data: {
|
|
...data,
|
|
type: data.type.toUpperCase() as any,
|
|
status: data.status.toUpperCase() as any,
|
|
},
|
|
});
|
|
|
|
return {
|
|
...music,
|
|
type: music.type as unknown as MusicType,
|
|
status: music.status as unknown as MusicStatus,
|
|
dateAdded: music.dateAdded,
|
|
dateStarted: music.dateStarted || undefined,
|
|
dateCompleted: music.dateCompleted || undefined,
|
|
dateFinished: music.dateFinished || undefined,
|
|
tags: music.tags ?? [],
|
|
links: music.links ?? [],
|
|
createdAt: music.createdAt,
|
|
updatedAt: music.updatedAt,
|
|
};
|
|
}
|
|
|
|
/**
|
|
* Update music by ID.
|
|
*/
|
|
async updateMusic(id: string, data: UpdateMusicDto): Promise<Music> {
|
|
// Validate input
|
|
this.validateMusicData(data);
|
|
|
|
const updateData = { ...data };
|
|
if (updateData.type) {
|
|
updateData.type = updateData.type.toUpperCase() as any;
|
|
}
|
|
if (updateData.status) {
|
|
updateData.status = updateData.status.toUpperCase() as any;
|
|
}
|
|
|
|
const music = await this.prisma.music.update({
|
|
where: { id },
|
|
data: updateData,
|
|
});
|
|
|
|
return {
|
|
...music,
|
|
type: music.type as unknown as MusicType,
|
|
status: music.status as unknown as MusicStatus,
|
|
dateAdded: music.dateAdded,
|
|
dateStarted: music.dateStarted || undefined,
|
|
dateCompleted: music.dateCompleted || undefined,
|
|
dateFinished: music.dateFinished || undefined,
|
|
tags: music.tags ?? [],
|
|
links: music.links ?? [],
|
|
createdAt: music.createdAt,
|
|
updatedAt: music.updatedAt,
|
|
};
|
|
}
|
|
|
|
/**
|
|
* Delete music by ID.
|
|
*/
|
|
async deleteMusic(id: string): Promise<void> {
|
|
await this.prisma.music.delete({
|
|
where: { id },
|
|
});
|
|
}
|
|
} |