implement auth checks for captcha and drop count limiting

dallen4 · Oct 8, 2023 · a410f35 · a410f35
1 parent e0deb87
commit a410f35
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 7 deletions.
diff --git a/web/molecules/steps/SecretInputCard.tsx b/web/molecules/steps/SecretInputCard.tsx
@@ -1,4 +1,4 @@
-import React, { useRef, useState } from 'react';
+import React, { useEffect, useRef, useState } from 'react';
 import {
     Text,
     PasswordInput,
@@ -7,13 +7,16 @@ import {
     JsonInput,
     SegmentedControl,
     Group,
+    useMantineTheme,
+    Box,
 } from '@mantine/core';
 import StepCard from './StepCard';
 import { useDropContext } from 'contexts/DropContext';
 import type { PayloadInputMode } from '@shared/types/common';
 import { Captcha } from 'atoms/Captcha';
 import { ACCEPTED_FILE_TYPES, MAX_PAYLOAD_SIZE } from '@shared/config/files';
 import { CONFIRM_PAYLOAD_BTN_ID } from 'lib/constants';
+import { useUser } from '@auth0/nextjs-auth0/client';
 
 export const SecretInputCard = () => {
     const [mode, setMode] = useState<PayloadInputMode>('text');
@@ -22,12 +25,20 @@ export const SecretInputCard = () => {
     const [canConfirm, setCanConfirm] = useState(
         process.env.NODE_ENV === 'development',
     );
+    const { user } = useUser();
 
     const textRef = useRef<HTMLInputElement>(null);
     const jsonRef = useRef<HTMLTextAreaElement>(null);
 
+    const theme = useMantineTheme();
+
     const { setPayload } = useDropContext();
 
+    useEffect(() => {
+        if (user) setCanConfirm(true);
+        else setCanConfirm(false);
+    }, [user]);
+
     const isValidJson = (input: string) => {
         try {
             JSON.parse(input);
@@ -62,7 +73,7 @@ export const SecretInputCard = () => {
     };
 
     return (
-        <StepCard title={'waiting for secrets'}>
+        <StepCard title={'add your secret'}>
             <SegmentedControl
                 value={mode}
                 onChange={(newMode) => setMode(newMode as PayloadInputMode)}
@@ -80,6 +91,7 @@ export const SecretInputCard = () => {
                         value: 'file',
                     },
                 ]}
+                style={{ marginTop: theme.spacing.sm, marginBottom: theme.spacing.sm }}
             />
             {mode === 'text' ? (
                 <PasswordInput
@@ -118,14 +130,19 @@ export const SecretInputCard = () => {
             ) : (
                 <Text>Invalid Payload Mode</Text>
             )}
-            <Captcha
-                onSuccess={() => setCanConfirm(true)}
-                onExpire={() => setCanConfirm(false)}
-            />
+            {!false && (
+                <Box style={{ marginTop: theme.spacing.lg }}>
+                    <Captcha
+                        onSuccess={() => setCanConfirm(true)}
+                        onExpire={() => setCanConfirm(false)}
+                    />
+                </Box>
+            )}
             <Button
                 id={CONFIRM_PAYLOAD_BTN_ID}
                 onClick={confirmPayload}
                 disabled={!canConfirm || !isValid}
+                style={{ marginTop: theme.spacing.md }}
             >
                 Confirm Payload
             </Button>

diff --git a/web/pages/api/drop.ts b/web/pages/api/drop.ts
@@ -8,10 +8,13 @@ import { createDrop } from 'api/drops';
 import { DISABLE_CAPTCHA_COOKIE } from '@config/cookies';
 import { cors } from 'api/middleware/cors';
 import { runMiddleware } from 'api/middleware';
+import { getSession } from '@auth0/nextjs-auth0';
 
 export default async function drop(req: NextApiRequest, res: NextApiResponse) {
     await runMiddleware(req, res, cors);
 
+    const session = await getSession(req, res);
+
     if (!['POST', 'GET', 'DELETE'].includes(req.method!)) {
         res.setHeader('Allow', 'POST,GET,DELETE');
         res.status(405).end('Method Not Allowed');
@@ -36,7 +39,7 @@ export default async function drop(req: NextApiRequest, res: NextApiResponse) {
     } else if (req.method === 'POST') {
         const userIpAddr = getClientIp(req);
 
-        const canDrop = req.cookies[DISABLE_CAPTCHA_COOKIE]
+        const canDrop = req.cookies[DISABLE_CAPTCHA_COOKIE] || !!session
             ? true
             : await checkAndIncrementDropCount(userIpAddr!);