3pp-mirror/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2025-07-19 14:47:13 +02:00
Code Issues Projects Releases Packages Wiki Activity

✨ Add stricter validation on events endpoint

Browse source
This commit is contained in:
Andrey Antukh 2023-07-04 12:59:59 +02:00
parent e0c0b251a9
commit 7b0d3bdcab
1 changed files with 16 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

34
backend/src/app/rpc/commands/audit.clj
View file

@ -9,7 +9,7 @@
(:require (:require
[app.common.data :as d] [app.common.data :as d]
[app.common.logging :as l] [app.common.logging :as l]
[app.common.spec :as us] [app.common.schema :as sm]
[app.common.uuid :as uuid] [app.common.uuid :as uuid]
[app.config :as cf] [app.config :as cf]
[app.db :as db] [app.db :as db]
@ -19,9 +19,7 @@
[app.rpc.climit :as-alias climit] [app.rpc.climit :as-alias climit]
[app.rpc.doc :as-alias doc] [app.rpc.doc :as-alias doc]
[app.rpc.helpers :as rph] [app.rpc.helpers :as rph]
[app.util.services :as sv] [app.util.services :as sv]))
[app.util.time :as dt]
[clojure.spec.alpha :as s]))
(defn- event->row [event] (defn- event->row [event]
[(uuid/next) [(uuid/next)
@ -52,25 +50,25 @@
(when (seq events) (when (seq events)
(db/insert-multi! pool :audit-log event-columns events)))) (db/insert-multi! pool :audit-log event-columns events))))
(s/def ::name ::us/string) (def schema:event
(s/def ::type ::us/string) [:schema {:registry
(s/def ::props (s/map-of ::us/keyword any?)) {::valid-any [:or ::sm/inst :int :double [:string {:max 250}]]}}
(s/def ::timestamp dt/instant?) [:map {:title "Event"}
(s/def ::context (s/map-of ::us/keyword any?)) [:name [:string {:max 250}]]
[:type [:string {:max 250}]]
[:props
[:map-of :keyword ::valid-any]]
[:context {:optional true}
[:map-of :keyword ::valid-any]]]])
(s/def ::event (def schema:push-audit-events
(s/keys :req-un [::type ::name ::props ::timestamp] [:map {:title "push-audit-events"}
:opt-un [::context])) [:events [:vector schema:event]]])
(s/def ::events (s/every ::event))
(s/def ::push-audit-events
(s/keys :req [::rpc/profile-id]
:req-un [::events]))
(sv/defmethod ::push-audit-events (sv/defmethod ::push-audit-events
{::climit/id :submit-audit-events-by-profile {::climit/id :submit-audit-events-by-profile
::climit/key-fn ::rpc/profile-id ::climit/key-fn ::rpc/profile-id
::sm/params schema:push-audit-events
::audit/skip true ::audit/skip true
::doc/added "1.17"} ::doc/added "1.17"}
[{:keys [::db/pool] :as cfg} params] [{:keys [::db/pool] :as cfg} params]