build: 🔒️ Add extra user check in api

apps/builder/pages/api/coupons/redeem.ts

@@ -1,17 +1,14 @@
 import { withSentry } from '@sentry/nextjs'
-import { Prisma, User } from 'db'
+import { Prisma } from 'db'
 import prisma from 'libs/prisma'
 import { NextApiRequest, NextApiResponse } from 'next'
-import { getSession } from 'next-auth/react'
+import { getAuthenticatedUser } from 'services/api/utils'
+import { notAuthenticated } from 'utils'
 
 const handler = async (req: NextApiRequest, res: NextApiResponse) => {
   if (req.method === 'POST') {
-    const session = await getSession({ req })
-
-    if (!session?.user)
-      return res.status(401).json({ message: 'Not authenticated' })
-
-    const user = session.user as User
+    const user = await getAuthenticatedUser(req)
+    if (!user) return notAuthenticated(res)
     const { code } =
       typeof req.body === 'string' ? JSON.parse(req.body) : req.body
     const coupon = await prisma.coupon.findFirst({

apps/builder/pages/api/credentials/google-sheets/callback.ts

@@ -1,26 +1,24 @@
 import { NextApiRequest, NextApiResponse } from 'next'
-import { getSession } from 'next-auth/react'
-import { Prisma, User } from 'db'
+import { Prisma } from 'db'
 import prisma from 'libs/prisma'
 import { googleSheetsScopes } from './consent-url'
 import { stringify } from 'querystring'
 import { CredentialsType } from 'models'
-import { encrypt } from 'utils'
+import { encrypt, notAuthenticated } from 'utils'
 import { oauth2Client } from 'libs/google-sheets'
 import { withSentry } from '@sentry/nextjs'
+import { getAuthenticatedUser } from 'services/api/utils'
 
 const handler = async (req: NextApiRequest, res: NextApiResponse) => {
-  const session = await getSession({ req })
+  const user = await getAuthenticatedUser(req)
+  if (!user) return notAuthenticated(res)
   const { redirectUrl, stepId } = JSON.parse(
     Buffer.from(req.query.state.toString(), 'base64').toString()
   )
   if (req.method === 'GET') {
     const code = req.query.code.toString()
     if (!code)
       return res.status(400).send({ message: "Bad request, couldn't get code" })
-    if (!session?.user)
-      return res.status(401).json({ message: 'Not authenticated' })
-    const user = session.user as User
     const { tokens } = await oauth2Client.getToken(code)
     if (!tokens?.access_token) {
       console.error('Error getting oAuth tokens:')

apps/builder/pages/api/folders.ts

@@ -1,17 +1,14 @@
 import { withSentry } from '@sentry/nextjs'
-import { DashboardFolder, User } from 'db'
+import { DashboardFolder } from 'db'
 import prisma from 'libs/prisma'
 import { NextApiRequest, NextApiResponse } from 'next'
-import { getSession } from 'next-auth/react'
-import { methodNotAllowed } from 'utils'
+import { getAuthenticatedUser } from 'services/api/utils'
+import { methodNotAllowed, notAuthenticated } from 'utils'
 
 const handler = async (req: NextApiRequest, res: NextApiResponse) => {
-  const session = await getSession({ req })
+  const user = await getAuthenticatedUser(req)
+  if (!user) return notAuthenticated(res)
 
-  if (!session?.user)
-    return res.status(401).json({ message: 'Not authenticated' })
-
-  const user = session.user as User
   const parentFolderId = req.query.parentId
     ? req.query.parentId.toString()
     : null

apps/builder/pages/api/folders/[id].ts

@@ -1,18 +1,15 @@
 import { withSentry } from '@sentry/nextjs'
-import { DashboardFolder, User } from 'db'
+import { DashboardFolder } from 'db'
 import prisma from 'libs/prisma'
 import { NextApiRequest, NextApiResponse } from 'next'
-import { getSession } from 'next-auth/react'
-import { methodNotAllowed } from 'utils'
+import { getAuthenticatedUser } from 'services/api/utils'
+import { methodNotAllowed, notAuthenticated } from 'utils'
 
 const handler = async (req: NextApiRequest, res: NextApiResponse) => {
-  const session = await getSession({ req })
-
-  if (!session?.user)
-    return res.status(401).json({ message: 'Not authenticated' })
+  const user = await getAuthenticatedUser(req)
+  if (!user) return notAuthenticated(res)
 
   const id = req.query.id.toString()
-  const user = session.user as User
   if (req.method === 'GET') {
     const folder = await prisma.dashboardFolder.findUnique({
       where: { id_ownerId: { id, ownerId: user.id } },

apps/builder/pages/api/integrations/google-sheets/spreadsheets.ts

@@ -1,18 +1,14 @@
 import { NextApiRequest, NextApiResponse } from 'next'
 import { drive } from '@googleapis/drive'
 import { getAuthenticatedGoogleClient } from 'libs/google-sheets'
-import { methodNotAllowed } from 'utils'
-import { getSession } from 'next-auth/react'
-import { User } from 'db'
+import { methodNotAllowed, notAuthenticated } from 'utils'
 import { setUser, withSentry } from '@sentry/nextjs'
+import { getAuthenticatedUser } from 'services/api/utils'
 
 const handler = async (req: NextApiRequest, res: NextApiResponse) => {
-  const session = await getSession({ req })
+  const user = await getAuthenticatedUser(req)
+  if (!user) return notAuthenticated(res)
 
-  if (!session?.user)
-    return res.status(401).json({ message: 'Not authenticated' })
-
-  const user = session.user as User
   setUser({ email: user.email ?? undefined, id: user.id })
   if (req.method === 'GET') {
     const credentialsId = req.query.credentialsId.toString()

apps/builder/pages/api/integrations/google-sheets/spreadsheets/[id]/sheets.ts

@@ -1,18 +1,14 @@
 import { NextApiRequest, NextApiResponse } from 'next'
 import { GoogleSpreadsheet } from 'google-spreadsheet'
 import { getAuthenticatedGoogleClient } from 'libs/google-sheets'
-import { isDefined, methodNotAllowed } from 'utils'
-import { getSession } from 'next-auth/react'
-import { User } from 'db'
+import { isDefined, methodNotAllowed, notAuthenticated } from 'utils'
 import { withSentry, setUser } from '@sentry/nextjs'
+import { getAuthenticatedUser } from 'services/api/utils'
 
 const handler = async (req: NextApiRequest, res: NextApiResponse) => {
-  const session = await getSession({ req })
+  const user = await getAuthenticatedUser(req)
+  if (!user) return notAuthenticated(res)
 
-  if (!session?.user)
-    return res.status(401).json({ message: 'Not authenticated' })
-
-  const user = session.user as User
   setUser({ email: user.email ?? undefined, id: user.id })
   if (req.method === 'GET') {
     const credentialsId = req.query.credentialsId.toString()

apps/builder/pages/api/publicTypebots.ts

@@ -1,15 +1,12 @@
 import { withSentry } from '@sentry/nextjs'
 import prisma from 'libs/prisma'
 import { NextApiRequest, NextApiResponse } from 'next'
-import { getSession } from 'next-auth/react'
-import { methodNotAllowed } from 'utils'
+import { getAuthenticatedUser } from 'services/api/utils'
+import { methodNotAllowed, notAuthenticated } from 'utils'
 
 const handler = async (req: NextApiRequest, res: NextApiResponse) => {
-  const session = await getSession({ req })
-
-  if (!session?.user)
-    return res.status(401).json({ message: 'Not authenticated' })
-
+  const user = await getAuthenticatedUser(req)
+  if (!user) return notAuthenticated(res)
   try {
     if (req.method === 'POST') {
       const data =

apps/builder/pages/api/publicTypebots/[id].ts

@@ -1,14 +1,12 @@
 import { withSentry } from '@sentry/nextjs'
 import prisma from 'libs/prisma'
 import { NextApiRequest, NextApiResponse } from 'next'
-import { getSession } from 'next-auth/react'
-import { methodNotAllowed } from 'utils'
+import { getAuthenticatedUser } from 'services/api/utils'
+import { methodNotAllowed, notAuthenticated } from 'utils'
 
 const handler = async (req: NextApiRequest, res: NextApiResponse) => {
-  const session = await getSession({ req })
-
-  if (!session?.user)
-    return res.status(401).json({ message: 'Not authenticated' })
+  const user = await getAuthenticatedUser(req)
+  if (!user) return notAuthenticated(res)
 
   const id = req.query.id.toString()
   if (req.method === 'PUT') {

apps/builder/pages/api/typebots.ts

@@ -1,17 +1,14 @@
 import { withSentry } from '@sentry/nextjs'
-import { Prisma, User } from 'db'
+import { Prisma } from 'db'
 import prisma from 'libs/prisma'
 import { NextApiRequest, NextApiResponse } from 'next'
-import { getSession } from 'next-auth/react'
+import { getAuthenticatedUser } from 'services/api/utils'
 import { parseNewTypebot } from 'services/typebots/typebots'
-import { methodNotAllowed } from 'utils'
+import { methodNotAllowed, notAuthenticated } from 'utils'
 
 const handler = async (req: NextApiRequest, res: NextApiResponse) => {
-  const session = await getSession({ req })
-  if (!session?.user)
-    return res.status(401).json({ message: 'Not authenticated' })
-  const user = session.user as User
-  if (!user.id) return res.status(401).json({ message: 'Not authenticated' })
+  const user = await getAuthenticatedUser(req)
+  if (!user) return notAuthenticated(res)
   try {
     if (req.method === 'GET') {
       const folderId = req.query.folderId ? req.query.folderId.toString() : null

apps/builder/pages/api/typebots/[typebotId].ts

@@ -2,19 +2,16 @@ import { withSentry } from '@sentry/nextjs'
 import { CollaborationType, Prisma, User } from 'db'
 import prisma from 'libs/prisma'
 import { NextApiRequest, NextApiResponse } from 'next'
-import { getSession } from 'next-auth/react'
-import { methodNotAllowed } from 'utils'
+import { getAuthenticatedUser } from 'services/api/utils'
+import { methodNotAllowed, notAuthenticated } from 'utils'
 
 const adminEmail = 'contact@baptiste-arnaud.fr'
 
 const handler = async (req: NextApiRequest, res: NextApiResponse) => {
-  const session = await getSession({ req })
-
-  if (!session?.user)
-    return res.status(401).json({ message: 'Not authenticated' })
+  const user = await getAuthenticatedUser(req)
+  if (!user) return notAuthenticated(res)
 
   const typebotId = req.query.typebotId.toString()
-  const user = session.user as User
   if (req.method === 'GET') {
     const typebot = await prisma.typebot.findFirst({
       where: parseWhereFilter(typebotId, user, 'read'),

apps/builder/pages/api/typebots/[typebotId]/results.ts

@@ -1,20 +1,15 @@
 import { withSentry } from '@sentry/nextjs'
-import { User } from 'db'
 import prisma from 'libs/prisma'
 import { NextApiRequest, NextApiResponse } from 'next'
-import { getSession } from 'next-auth/react'
+import { getAuthenticatedUser } from 'services/api/utils'
 import { isFreePlan } from 'services/user/user'
-import { methodNotAllowed } from 'utils'
+import { methodNotAllowed, notAuthenticated } from 'utils'
 
 const adminEmail = 'contact@baptiste-arnaud.fr'
 
 const handler = async (req: NextApiRequest, res: NextApiResponse) => {
-  const session = await getSession({ req })
-
-  if (!session?.user)
-    return res.status(401).send({ message: 'Not authenticated' })
-
-  const user = session.user as User
+  const user = await getAuthenticatedUser(req)
+  if (!user) return notAuthenticated(res)
   if (req.method === 'GET') {
     const typebotId = req.query.typebotId.toString()
     const lastResultId = req.query.lastResultId?.toString()

apps/builder/pages/api/typebots/[typebotId]/results/answers/count.ts

@@ -1,18 +1,13 @@
 import { PublicTypebot } from 'models'
-import { User } from 'db'
 import prisma from 'libs/prisma'
 import { NextApiRequest, NextApiResponse } from 'next'
-import { getSession } from 'next-auth/react'
-import { methodNotAllowed } from 'utils'
+import { methodNotAllowed, notAuthenticated } from 'utils'
 import { withSentry } from '@sentry/nextjs'
+import { getAuthenticatedUser } from 'services/api/utils'
 
 const handler = async (req: NextApiRequest, res: NextApiResponse) => {
-  const session = await getSession({ req })
-
-  if (!session?.user)
-    return res.status(401).send({ message: 'Not authenticated' })
-
-  const user = session.user as User
+  const user = await getAuthenticatedUser(req)
+  if (!user) return notAuthenticated(res)
   if (req.method === 'GET') {
     const typebotId = req.query.typebotId.toString()
     const typebot = await prisma.typebot.findUnique({

apps/builder/pages/api/typebots/[typebotId]/results/stats.ts

@@ -1,18 +1,13 @@
 import { withSentry } from '@sentry/nextjs'
-import { User } from 'db'
 import prisma from 'libs/prisma'
 import { Stats } from 'models'
 import { NextApiRequest, NextApiResponse } from 'next'
-import { getSession } from 'next-auth/react'
-import { methodNotAllowed } from 'utils'
+import { getAuthenticatedUser } from 'services/api/utils'
+import { methodNotAllowed, notAuthenticated } from 'utils'
 
 const handler = async (req: NextApiRequest, res: NextApiResponse) => {
-  const session = await getSession({ req })
-
-  if (!session?.user)
-    return res.status(401).send({ message: 'Not authenticated' })
-
-  const user = session.user as User
+  const user = await getAuthenticatedUser(req)
+  if (!user) return notAuthenticated(res)
   if (req.method === 'GET') {
     const typebotId = req.query.typebotId.toString()
 

apps/builder/pages/api/users/[id].ts

@@ -1,14 +1,12 @@
 import { withSentry } from '@sentry/nextjs'
 import prisma from 'libs/prisma'
 import { NextApiRequest, NextApiResponse } from 'next'
-import { getSession } from 'next-auth/react'
-import { methodNotAllowed } from 'utils'
+import { getAuthenticatedUser } from 'services/api/utils'
+import { methodNotAllowed, notAuthenticated } from 'utils'
 
 const handler = async (req: NextApiRequest, res: NextApiResponse) => {
-  const session = await getSession({ req })
-
-  if (!session?.user)
-    return res.status(401).json({ message: 'Not authenticated' })
+  const user = await getAuthenticatedUser(req)
+  if (!user) return notAuthenticated(res)
 
   const id = req.query.id.toString()
   if (req.method === 'PUT') {

apps/builder/pages/api/users/[id]/credentials.ts

@@ -1,18 +1,14 @@
 import { withSentry } from '@sentry/nextjs'
-import { Prisma, User } from 'db'
+import { Prisma } from 'db'
 import prisma from 'libs/prisma'
 import { Credentials } from 'models'
 import { NextApiRequest, NextApiResponse } from 'next'
-import { getSession } from 'next-auth/react'
-import { encrypt, methodNotAllowed } from 'utils'
+import { getAuthenticatedUser } from 'services/api/utils'
+import { encrypt, methodNotAllowed, notAuthenticated } from 'utils'
 
 const handler = async (req: NextApiRequest, res: NextApiResponse) => {
-  const session = await getSession({ req })
-
-  if (!session?.user)
-    return res.status(401).json({ message: 'Not authenticated' })
-
-  const user = session.user as User
+  const user = await getAuthenticatedUser(req)
+  if (!user) return notAuthenticated(res)
   const id = req.query.id.toString()
   if (user.id !== id) return res.status(401).send({ message: 'Forbidden' })
   if (req.method === 'GET') {