Merge pull request #700 from stakwork/feat/protect-admin

feat: added signature and message to all admin routes as query

src/components/AddContentModal/index.tsx

@@ -1,8 +1,8 @@
 import { useEffect, useState } from 'react'
 import { FieldValues, FormProvider, useForm } from 'react-hook-form'
 import * as sphinx from 'sphinx-bridge'
-import { BaseModal } from '~/components/Modal'
 import { notify } from '~/components/common/Toast/toastMessage'
+import { BaseModal } from '~/components/Modal'
 import {
   DOCUMENT,
   LINK,
@@ -17,7 +17,7 @@ import { api } from '~/network/api'
 import { useModal } from '~/stores/useModalStore'
 import { useUserStore } from '~/stores/useUserStore'
 import { SubmitErrRes } from '~/types'
-import { executeIfProd, getLSat, payLsat, updateBudget } from '~/utils'
+import { executeIfProd, generateAuthQueryParam, getLSat, payLsat, updateBudget } from '~/utils'
 import { BudgetStep } from './BudgetStep'
 import { LocationStep } from './LocationStep'
 import { SourceStep } from './SourceStep'
@@ -103,7 +103,15 @@ const handleSubmitForm = async (
   })
 
   try {
-    const res: SubmitErrRes = await api.post(`/${endPoint}`, JSON.stringify(body), {
+    let query = ''
+
+    if (endPoint === 'radar') {
+      const result = await generateAuthQueryParam()
+
+      query = `?${result}`
+    }
+
+    const res: SubmitErrRes = await api.post(`/${endPoint}${query}`, JSON.stringify(body), {
       Authorization: lsatToken,
     })
 

src/network/fetchSourcesData/index.ts

@@ -6,6 +6,7 @@ import {
   RadarRequest,
   SubmitErrRes,
 } from '~/types'
+import { generateAuthQueryParam } from '~/utils'
 import { api } from '../api'
 
 type TradarParams = {
@@ -68,8 +69,10 @@ export const getRadarData = async (queryParams: TradarParams = defaultParams) =>
 }
 
 export const getTopicsData = async (queryParams: TtopicsParams = defaultParams) => {
+  const query = await generateAuthQueryParam()
+
   const response = await api.get<FetchTopicResponse>(
-    `/topics?${new URLSearchParams({ ...defaultParams, ...queryParams }).toString()}`,
+    `/topics?${new URLSearchParams({ ...defaultParams, ...queryParams }).toString()}${query}`,
   )
 
   return response
@@ -88,51 +91,67 @@ export const getStats = async () => {
 }
 
 export const getEdgeTypes = async () => {
-  const response = await api.get<FetchEdgesResponse>('/curation/edge/type')
+  const query = await generateAuthQueryParam()
+
+  const response = await api.get<FetchEdgesResponse>(`curation/edge/type?${query}`)
 
   return response
 }
 
 export const postEdgeType = async (data: TAddEdgeParams) => {
-  const response = await api.post('/curation/edge', JSON.stringify(data))
+  const query = await generateAuthQueryParam()
+
+  const response = await api.post(`/curation/edge?${query}`, JSON.stringify(data))
 
   return response
 }
 
 export const postAboutData = async (data: TAboutParams) => {
-  const response = await api.post('/about', JSON.stringify(data))
+  const query = await generateAuthQueryParam()
+
+  const response = await api.post(`/about?${query}`, JSON.stringify(data))
 
   return response
 }
 
 export const postMergeTopics = async (data: TMergeTopicsParams) => {
-  const response = await api.post('/curation/merge', JSON.stringify(data))
+  const query = await generateAuthQueryParam()
+
+  const response = await api.post(`/curation/merge?${query}`, JSON.stringify(data))
 
   return response
 }
 
 export const triggerRadarJob = async () => api.get<SubmitErrRes>(`/radar/trigger-job`)
 
 export const putRadarData = async (id: string, data: RadarRequest) => {
-  const response = await api.put(`/radar/${id}`, JSON.stringify(data))
+  const query = await generateAuthQueryParam()
+
+  const response = await api.put(`/radar/${id}?${query}`, JSON.stringify(data))
 
   return response
 }
 
 export const putNodeData = async (data: NodeRequest) => {
-  const response = await api.put(`/node`, JSON.stringify(data))
+  const query = await generateAuthQueryParam()
+
+  const response = await api.put(`/node?${query}`, JSON.stringify(data))
 
   return response
 }
 
 export const approveRadarData = async (id: string, pubkey: string) => {
-  const response = await api.put(`/radar/${id}/approve`, JSON.stringify({ approve: 'True', pubkey }))
+  const query = await generateAuthQueryParam()
+
+  const response = await api.put(`/radar/${id}/approve?${query}`, JSON.stringify({ approve: 'True', pubkey }))
 
   return response
 }
 
 export const deleteRadarData = async (id: string) => {
-  const response = await api.delete(`/radar/${id}`)
+  const query = await generateAuthQueryParam()
+
+  const response = await api.delete(`/radar/${id}?${query}`)
 
   return response
 }

src/utils/getSignedMessage/index.ts

@@ -21,3 +21,9 @@ export async function getSignedMessageFromRelay(): Promise<{ message: string; si
     return { message: '', signature: '' }
   }
 }
+
+export async function generateAuthQueryParam() {
+  const res = await getSignedMessageFromRelay()
+
+  return `sig=${res.signature}&msg=${res.message}`
+}

src/utils/index.ts

@@ -18,7 +18,7 @@ import { timeToMilliseconds } from './timeToMilliseconds'
 import { useIsMatchBreakpoint } from './useIsMatchBreakpoint'
 // import APP_VERSION from './versionHelper'
 import { extractUuidAndHost } from './auth'
-import { getSignedMessageFromRelay } from './getSignedMessage'
+import { generateAuthQueryParam, getSignedMessageFromRelay } from './getSignedMessage'
 import { videoTimeToSeconds } from './videoTimetoSeconds'
 
 export {
@@ -47,4 +47,5 @@ export {
   videoTimeToSeconds,
   getSignedMessageFromRelay,
   extractUuidAndHost,
+  generateAuthQueryParam,
 }