Ghost/ghost/audience-feedback/lib/AudienceFeedbackService.js
Steve Larson dac2561252
🔒 Added uuid verification to member endpoints not requiring a session
ref https://linear.app/tryghost/issue/ENG-1364
ref https://linear.app/tryghost/issue/ENG-1464

- credits to https://github.com/1337Nerd
- added a hashed value to endpoints that do not require a member sign in in order to verify the source of the link and resulting request
- added redirect to sign in page when trying to access newsletter
management
2024-08-20 16:24:02 +02:00

35 lines
977 B
JavaScript

class AudienceFeedbackService {
/** @type URL */
#baseURL;
/** @type {Object} */
#urlService;
/**
* @param {object} deps
* @param {object} deps.config
* @param {URL} deps.config.baseURL
* @param {object} deps.urlService
*/
constructor(deps) {
this.#baseURL = deps.config.baseURL;
this.#urlService = deps.urlService;
}
/**
* @param {string} uuid
* @param {string} postId
* @param {0 | 1} score
* @param {string} key - hashed uuid value
*/
buildLink(uuid, postId, score, key) {
let postUrl = this.#urlService.getUrlByResourceId(postId, {absolute: true});
if (postUrl.match(/\/404\//)) {
postUrl = this.#baseURL;
}
const url = new URL(postUrl);
url.hash = `#/feedback/${postId}/${score}/?uuid=${encodeURIComponent(uuid)}&key=${encodeURIComponent(key)}`;
return url;
}
}
module.exports = AudienceFeedbackService;