security: harden employee edge function boundary
This commit is contained in:
pavlov346346-source
parent
3fd899978b
commit
7044d36ae6
@ -1,13 +1,36 @@
|
||||
import "jsr:@supabase/functions-js/edge-runtime.d.ts";
|
||||
import { createClient } from "npm:@supabase/supabase-js@2";
|
||||
import { createClient } from "npm:@supabase/supabase-js@2.116.0";
|
||||
|
||||
const cors = {
|
||||
"Access-Control-Allow-Origin": "*",
|
||||
const PROD_ORIGINS = new Set([
|
||||
"https://app.caterium.ru",
|
||||
"https://caterium.ru",
|
||||
"https://www.caterium.ru",
|
||||
]);
|
||||
const WORKERS_DEV_ORIGIN = /^https:\/\/[a-z0-9-]+(?:\.[a-z0-9-]+)*\.workers\.dev$/i;
|
||||
const LOCAL_ORIGIN = /^http:\/\/(?:localhost|127\.0\.0\.1)(?::\d{1,5})?$/i;
|
||||
const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
|
||||
const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
|
||||
const ALLOWED_ROLES = new Set(["owner", "admin", "manager", "operator", "viewer"]);
|
||||
|
||||
function allowedOrigin(origin: string) {
|
||||
if (!origin) return true;
|
||||
return PROD_ORIGINS.has(origin) || WORKERS_DEV_ORIGIN.test(origin) || LOCAL_ORIGIN.test(origin);
|
||||
}
|
||||
|
||||
function corsHeaders(req: Request) {
|
||||
const origin = req.headers.get("Origin") || "";
|
||||
const headers: Record<string, string> = {
|
||||
"Access-Control-Allow-Headers": "authorization, x-client-info, apikey, content-type",
|
||||
"Access-Control-Allow-Methods": "POST, OPTIONS",
|
||||
"Content-Type": "application/json",
|
||||
"Vary": "Origin",
|
||||
};
|
||||
const reply = (body: unknown, status = 200) => new Response(JSON.stringify(body), { status, headers: cors });
|
||||
if (origin && allowedOrigin(origin)) headers["Access-Control-Allow-Origin"] = origin;
|
||||
return headers;
|
||||
}
|
||||
|
||||
const reply = (req: Request, body: unknown, status = 200) =>
|
||||
new Response(JSON.stringify(body), { status, headers: corsHeaders(req) });
|
||||
|
||||
type PrepData = {
|
||||
status?: string;
|
||||
@ -17,26 +40,55 @@ type PrepData = {
|
||||
role?: string;
|
||||
};
|
||||
|
||||
function publicError(error: unknown) {
|
||||
const message = error instanceof Error ? error.message : String(error || "");
|
||||
if (/access denied|permission|not allowed/i.test(message)) return { status: 403, error: "Недостаточно прав для добавления сотрудника.", code: "forbidden" };
|
||||
if (/subscription|blocked|plan/i.test(message)) return { status: 403, error: "Добавление сотрудника недоступно для текущего тарифа.", code: "plan_restricted" };
|
||||
if (/limit|maximum|max_members/i.test(message)) return { status: 409, error: "Достигнут лимит сотрудников для текущего тарифа.", code: "member_limit" };
|
||||
if (/already registered|already exists|duplicate/i.test(message)) return { status: 409, error: "Аккаунт с этим email уже существует.", code: "account_exists" };
|
||||
return { status: 500, error: "Не удалось добавить сотрудника. Повторите попытку.", code: "employee_create_failed" };
|
||||
}
|
||||
|
||||
Deno.serve(async (req: Request) => {
|
||||
if (req.method === "OPTIONS") return new Response("ok", { headers: cors });
|
||||
if (req.method !== "POST") return reply({ error: "Method not allowed" }, 405);
|
||||
const origin = req.headers.get("Origin") || "";
|
||||
if (origin && !allowedOrigin(origin)) return reply(req, { error: "Origin is not allowed", code: "origin_not_allowed" }, 403);
|
||||
if (req.method === "OPTIONS") return new Response("ok", { headers: corsHeaders(req) });
|
||||
if (req.method !== "POST") return reply(req, { error: "Method not allowed", code: "method_not_allowed" }, 405);
|
||||
|
||||
try {
|
||||
const auth = req.headers.get("Authorization") || "";
|
||||
if (!/^Bearer\s+\S+/i.test(auth)) return reply(req, { error: "Требуется авторизация.", code: "unauthorized" }, 401);
|
||||
|
||||
const url = Deno.env.get("SUPABASE_URL") || "";
|
||||
const anon = Deno.env.get("SUPABASE_ANON_KEY") || "";
|
||||
const serviceKey = Deno.env.get("SUPABASE_SERVICE_ROLE_KEY") || "";
|
||||
if (!url || !anon || !serviceKey) return reply({ error: "Server auth configuration is incomplete" }, 500);
|
||||
if (!url || !anon || !serviceKey) {
|
||||
console.error("[caterium-create-employee] incomplete server auth configuration");
|
||||
return reply(req, { error: "Сервис временно недоступен.", code: "server_configuration" }, 503);
|
||||
}
|
||||
|
||||
let body: Record<string, unknown>;
|
||||
try {
|
||||
body = await req.json();
|
||||
} catch (_) {
|
||||
return reply(req, { error: "Некорректный формат запроса.", code: "invalid_json" }, 400);
|
||||
}
|
||||
|
||||
const workspaceId = String(body.workspace_id || "").trim();
|
||||
const email = String(body.email || "").trim().toLowerCase();
|
||||
const displayName = String(body.display_name || "").trim();
|
||||
const role = String(body.role || "manager").trim().toLowerCase();
|
||||
|
||||
if (!UUID_RE.test(workspaceId)) return reply(req, { error: "Некорректная компания.", code: "invalid_workspace" }, 400);
|
||||
if (!EMAIL_RE.test(email) || email.length > 254) return reply(req, { error: "Введите корректный email.", code: "invalid_email" }, 400);
|
||||
if (displayName.length > 120) return reply(req, { error: "Имя сотрудника слишком длинное.", code: "invalid_display_name" }, 400);
|
||||
if (!ALLOWED_ROLES.has(role)) return reply(req, { error: "Некорректная роль сотрудника.", code: "invalid_role" }, 400);
|
||||
|
||||
const caller = createClient(url, anon, {
|
||||
global: { headers: { Authorization: auth } },
|
||||
auth: { persistSession: false, autoRefreshToken: false },
|
||||
});
|
||||
const service = createClient(url, serviceKey, { auth: { persistSession: false, autoRefreshToken: false } });
|
||||
const body = await req.json();
|
||||
const workspaceId = String(body.workspace_id || "");
|
||||
const email = String(body.email || "").trim().toLowerCase();
|
||||
const displayName = String(body.display_name || "").trim();
|
||||
const role = String(body.role || "manager");
|
||||
|
||||
const prepare = async () => {
|
||||
const result = await caller.rpc("sun_employee_prepare_v28", {
|
||||
@ -57,7 +109,7 @@ Deno.serve(async (req: Request) => {
|
||||
p_role: role,
|
||||
});
|
||||
if (fin.error) throw new Error(fin.error.message);
|
||||
return reply({
|
||||
return reply(req, {
|
||||
...fin.data,
|
||||
created,
|
||||
temporary_password: temporaryPassword,
|
||||
@ -69,7 +121,7 @@ Deno.serve(async (req: Request) => {
|
||||
const prepStatus = String(prep.status || "");
|
||||
|
||||
if (prepStatus === "already_member") {
|
||||
return reply({
|
||||
return reply(req, {
|
||||
status: "already_member",
|
||||
user_id: prep.user_id,
|
||||
email: prep.email || email,
|
||||
@ -83,13 +135,11 @@ Deno.serve(async (req: Request) => {
|
||||
|
||||
if (prepStatus === "existing") {
|
||||
const existingUserId = String(prep.user_id || "");
|
||||
if (!existingUserId) return reply({ error: "Existing employee account has no user id" }, 409);
|
||||
if (!UUID_RE.test(existingUserId)) throw new Error("Existing employee account has no valid user id");
|
||||
return await finalize(existingUserId, false, null);
|
||||
}
|
||||
|
||||
if (prepStatus !== "new") {
|
||||
return reply({ error: `Unexpected employee prepare status: ${prepStatus || "empty"}` }, 409);
|
||||
}
|
||||
if (prepStatus !== "new") throw new Error(`Unexpected employee prepare status: ${prepStatus || "empty"}`);
|
||||
|
||||
const alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789";
|
||||
const bytes = crypto.getRandomValues(new Uint8Array(12));
|
||||
@ -109,12 +159,10 @@ Deno.serve(async (req: Request) => {
|
||||
});
|
||||
|
||||
if (created.error || !created.data.user) {
|
||||
// A concurrent request or a previous partial failure may have created Auth already.
|
||||
// Re-read server state and finalize the existing account instead of leaving the workspace half-configured.
|
||||
const retryPrep = await prepare();
|
||||
const retryStatus = String(retryPrep.status || "");
|
||||
if (retryStatus === "already_member") {
|
||||
return reply({
|
||||
return reply(req, {
|
||||
status: "already_member",
|
||||
user_id: retryPrep.user_id,
|
||||
email: retryPrep.email || email,
|
||||
@ -125,14 +173,14 @@ Deno.serve(async (req: Request) => {
|
||||
must_change_password: false,
|
||||
});
|
||||
}
|
||||
if (retryStatus === "existing" && retryPrep.user_id) {
|
||||
return await finalize(String(retryPrep.user_id), false, null);
|
||||
}
|
||||
return reply({ error: created.error?.message || "Create failed" }, 400);
|
||||
if (retryStatus === "existing" && retryPrep.user_id) return await finalize(String(retryPrep.user_id), false, null);
|
||||
throw new Error(created.error?.message || "Employee auth creation failed");
|
||||
}
|
||||
|
||||
return await finalize(created.data.user.id, true, password);
|
||||
} catch (e) {
|
||||
return reply({ error: e instanceof Error ? e.message : String(e) }, 500);
|
||||
} catch (error) {
|
||||
console.error("[caterium-create-employee]", error);
|
||||
const safe = publicError(error);
|
||||
return reply(req, { error: safe.error, code: safe.code }, safe.status);
|
||||
}
|
||||
});
|
||||
|
||||
Loading…
Reference in New Issue
Block a user