111 lines
3.7 KiB
TypeScript
111 lines
3.7 KiB
TypeScript
import SuperJSON from "superjson";
|
|
import { z } from "zod/v4";
|
|
|
|
import type { Session } from "@homarr/auth";
|
|
import type { Database } from "@homarr/db";
|
|
import { eq } from "@homarr/db";
|
|
import { items, users } from "@homarr/db/schema";
|
|
import { createLogger } from "@homarr/core/infrastructure/logs";
|
|
import { rssFeedsRequestHandler } from "@homarr/request-handler/rss-feeds";
|
|
|
|
import type { WidgetComponentProps } from "../../../../widgets/src";
|
|
import { createTRPCRouter, publicProcedure } from "../../trpc";
|
|
|
|
const logger = createLogger({ module: "rssFeed" });
|
|
|
|
const feedsInput = z.object({
|
|
urls: z.array(z.string()).max(100),
|
|
maximumAmountPosts: z.number(),
|
|
});
|
|
|
|
export const rssFeedRouter = createTRPCRouter({
|
|
getFeeds: publicProcedure.input(feedsInput).query(async ({ ctx, input }) => {
|
|
const urls = (await canAccessAllFeedsAsync(ctx.db, ctx.session))
|
|
? input.urls
|
|
: await restrictUrlsAsync(ctx.db, input.urls);
|
|
|
|
const settled = await Promise.allSettled(
|
|
urls.map(async (url) => {
|
|
const innerHandler = rssFeedsRequestHandler.handler({
|
|
url,
|
|
count: input.maximumAmountPosts,
|
|
});
|
|
return await innerHandler.getDataAsync();
|
|
}),
|
|
);
|
|
|
|
return settled
|
|
.flatMap((result, index) => {
|
|
if (result.status === "fulfilled") return result.value.data.entries;
|
|
logger.warn("RSS feed fetch failed", { url: urls[index], error: result.reason });
|
|
return [];
|
|
})
|
|
.toSorted((entryA, entryB) => {
|
|
return entryA.published && entryB.published
|
|
? new Date(entryB.published).getTime() - new Date(entryA.published).getTime()
|
|
: 0;
|
|
})
|
|
.slice(0, input.maximumAmountPosts);
|
|
}),
|
|
});
|
|
|
|
export async function canAccessAllFeedsAsync(db: Database, session: Session | null) {
|
|
// Unauthenticated users can never access all feeds
|
|
if (!session) return false;
|
|
// Users with those permissions can modify a board and therefore add a rss feed widget with any feed url
|
|
if (session.user.permissions.includes("board-create") || session.user.permissions.includes("board-modify-all")) {
|
|
return true;
|
|
}
|
|
|
|
const user = await db.query.users.findFirst({
|
|
where: eq(users.id, session.user.id),
|
|
with: {
|
|
boards: {
|
|
columns: { id: true },
|
|
},
|
|
boardPermissions: true,
|
|
groups: {
|
|
with: {
|
|
group: {
|
|
with: { boardPermissions: true },
|
|
},
|
|
},
|
|
},
|
|
},
|
|
});
|
|
|
|
// Should never happen as the user is authenticated, but just in case
|
|
if (!user) return false;
|
|
|
|
// If user is owner of any board he has full access and can therefore create widgets with any feed url
|
|
if (user.boards.length >= 1) return true;
|
|
|
|
// If user has direct permissions on any board that allow modifying it, he can add a rss feed widget with any feed url
|
|
if (user.boardPermissions.some(({ permission }) => permission === "modify" || permission === "full")) {
|
|
return true;
|
|
}
|
|
|
|
// If user is in a group that has permissions on any board that allow modifying it, he can add a rss feed widget with any feed url
|
|
if (
|
|
user.groups.some(({ group }) =>
|
|
group.boardPermissions.some(({ permission }) => permission === "modify" || permission === "full"),
|
|
)
|
|
) {
|
|
return true;
|
|
}
|
|
|
|
// Fallback to not allowing access to all feeds
|
|
return false;
|
|
}
|
|
|
|
export async function restrictUrlsAsync(db: Database, urls: string[]) {
|
|
const rssFeedItems = await db.query.items.findMany({
|
|
where: eq(items.kind, "rssFeed"),
|
|
});
|
|
|
|
const configuredUrls = rssFeedItems
|
|
.map((item) => SuperJSON.parse<WidgetComponentProps<"rssFeed">["options"]>(item.options))
|
|
.flatMap((options) => options.feedUrls);
|
|
return urls.filter((url) => configuredUrls.includes(url));
|
|
}
|