From 8a99dd5c4b74a4ea2ce715aed5e517022621f05c Mon Sep 17 00:00:00 2001 From: Fuwn Date: Sat, 28 Mar 2026 06:02:54 +0000 Subject: fix(auth): ignore malformed user cookies --- src/routes/api/notifications/subscribe/+server.ts | 11 +++++++---- src/routes/api/notifications/unsubscribe/+server.ts | 11 +++++++---- 2 files changed, 14 insertions(+), 8 deletions(-) (limited to 'src/routes/api/notifications') diff --git a/src/routes/api/notifications/subscribe/+server.ts b/src/routes/api/notifications/subscribe/+server.ts index 806785e4..203470e0 100644 --- a/src/routes/api/notifications/subscribe/+server.ts +++ b/src/routes/api/notifications/subscribe/+server.ts @@ -1,6 +1,6 @@ -import { userIdentity } from "$lib/Data/AniList/identity"; +import { safeUserIdentity } from "$lib/Data/AniList/identity"; import { setUserSubscription } from "$lib/Database/SB/User/notifications"; -import { decodeAuthCookieOrThrow } from "$lib/Effect/authCookie"; +import { decodeAuthCookieOrNull } from "$lib/Effect/authCookie"; import { decodeRequestJsonOrThrow } from "$lib/Effect/requestBody"; import { Schema } from "effect"; @@ -12,8 +12,11 @@ export const POST = async ({ cookies, request, url }) => { if (!userCookie || !fingerprint) return unauthorised; - const user = decodeAuthCookieOrThrow(userCookie); - const userId = (await userIdentity(user)).id; + const user = decodeAuthCookieOrNull(userCookie); + + if (!user) return unauthorised; + + const userId = (await safeUserIdentity(user))?.id; if (!userId) return unauthorised; diff --git a/src/routes/api/notifications/unsubscribe/+server.ts b/src/routes/api/notifications/unsubscribe/+server.ts index 87f8b498..94bbd497 100644 --- a/src/routes/api/notifications/unsubscribe/+server.ts +++ b/src/routes/api/notifications/unsubscribe/+server.ts @@ -1,6 +1,6 @@ -import { userIdentity } from "$lib/Data/AniList/identity"; +import { safeUserIdentity } from "$lib/Data/AniList/identity"; import { deleteUserSubscription } from "$lib/Database/SB/User/notifications"; -import { decodeAuthCookieOrThrow } from "$lib/Effect/authCookie"; +import { decodeAuthCookieOrNull } from "$lib/Effect/authCookie"; const unauthorised = new Response("Unauthorised", { status: 401 }); @@ -10,8 +10,11 @@ export const POST = async ({ cookies, url }) => { if (!userCookie || !fingerprint) return unauthorised; - const user = decodeAuthCookieOrThrow(userCookie); - const userId = (await userIdentity(user)).id; + const user = decodeAuthCookieOrNull(userCookie); + + if (!user) return unauthorised; + + const userId = (await safeUserIdentity(user))?.id; if (!userId) return unauthorised; -- cgit v1.2.3