spchcap/speech.capital
1
0
Fork 0
mirror of https://github.com/spchcap/speech.capital.git synced 2026-01-14 16:48:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix: Add CORS headers to comments API

Browse Source
This commit is contained in:
multipleof4
2025-10-02 12:43:44 -07:00
parent 6b326a5a7b
commit 0b48f82ac0
1 changed files with 20 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
functions/api/comments.js
View File

@@ -1,21 +1,36 @@
const json=(d,o={})=>{const h=new Headers(o.headers);h.set('Content-Type','application/json');return new Response(JSON.stringify(d),{...o,headers:h})}; const json=(d,o={},req)=>{const h=new Headers(o.headers);h.set('Content-Type','application/json');const origin=req?.headers.get('Origin');if(origin?.endsWith('.speech.capital')){h.set('Access-Control-Allow-Origin',origin);h.set('Access-Control-Allow-Credentials','true');h.set('Access-Control-Allow-Methods','POST,OPTIONS');h.set('Access-Control-Allow-Headers','Content-Type')}return new Response(JSON.stringify(d),{...o,headers:h})};
const cookie=c=>(c.match(/auth_user=([^;]+)/)?.[1]||null); const cookie=c=>(c.match(/auth_user=([^;]+)/)?.[1]||null);
const hash=c=>(c.match(/auth_hash=([^;]+)/)?.[1]||null); const hash=c=>(c.match(/auth_hash=([^;]+)/)?.[1]||null);
const tsEq=(a,b)=>{if(!a||!b)return!1;let d=a.length^b.length;for(let i=0;i<a.length;i++)d|=a.charCodeAt(i)^b.charCodeAt(i);return d===0}; const tsEq=(a,b)=>{if(!a||!b)return!1;let d=a.length^b.length;for(let i=0;i<a.length;i++)d|=a.charCodeAt(i)^b.charCodeAt(i);return d===0};
const auth=async(req,db)=>{const c=req.headers.get('Cookie')||'',u=cookie(c),h=hash(c);if(!u||!h)return null;const user=await db.prepare('SELECT id,username,role,pass_hash FROM users WHERE username=?').bind(u).first();return user&&tsEq(user.pass_hash,h)?user:null}; const auth=async(req,db)=>{const c=req.headers.get('Cookie')||'',u=cookie(c),h=hash(c);if(!u||!h)return null;const user=await db.prepare('SELECT id,username,role,pass_hash FROM users WHERE username=?').bind(u).first();return user&&tsEq(user.pass_hash,h)?user:null};
export async function onRequest({request,env}){
if(request.method==='OPTIONS'){
const h=new Headers();
const origin=request.headers.get('Origin');
if(origin?.endsWith('.speech.capital')){
h.set('Access-Control-Allow-Origin',origin);
h.set('Access-Control-Allow-Credentials','true');
h.set('Access-Control-Allow-Methods','POST,OPTIONS');
h.set('Access-Control-Allow-Headers','Content-Type');
}
return new Response(null,{status:204,headers:h});
}
if(request.method==='POST')return onRequestPost({request,env});
}
export async function onRequestPost({request,env}){ export async function onRequestPost({request,env}){
try{ try{
const user=await auth(request,env.D1_SPCHCAP); const user=await auth(request,env.D1_SPCHCAP);
if(!user)return json({error:'Unauthorized'},{status:401}); if(!user)return json({error:'Unauthorized'},{status:401},request);
const{post_id,parent_id,content}=await request.json(); const{post_id,parent_id,content}=await request.json();
if(!post_id||!content)return json({error:'Missing fields'},{status:400}); if(!post_id||!content)return json({error:'Missing fields'},{status:400},request);
const{meta}=await env.D1_SPCHCAP.prepare('INSERT INTO comments(post_id,user_id,parent_id,content)VALUES(?,?,?,?)').bind(post_id,user.id,parent_id||null,content).run(); const{meta}=await env.D1_SPCHCAP.prepare('INSERT INTO comments(post_id,user_id,parent_id,content)VALUES(?,?,?,?)').bind(post_id,user.id,parent_id||null,content).run();
await env.D1_SPCHCAP.prepare('UPDATE posts SET comment_count=comment_count+1 WHERE id=?').bind(post_id).run(); await env.D1_SPCHCAP.prepare('UPDATE posts SET comment_count=comment_count+1 WHERE id=?').bind(post_id).run();
if(parent_id)await env.D1_SPCHCAP.prepare('UPDATE comments SET reply_count=reply_count+1 WHERE id=?').bind(parent_id).run(); if(parent_id)await env.D1_SPCHCAP.prepare('UPDATE comments SET reply_count=reply_count+1 WHERE id=?').bind(parent_id).run();
return json({id:meta.last_row_id},{status:201}); return json({id:meta.last_row_id},{status:201},request);
}catch(e){return json({error:{message:e.message}},{status:500})} }catch(e){return json({error:{message:e.message}},{status:500},request)}
} }