apps/api/src/app/connect/connect.controller.ts - next - githubmirror/novu

apps/api/src/app/connect/connect.controller.ts

52 строки2 KB

Dima Grossman

fix(api-service): harden keyless flow against IP collision and claim RBAC bypass fixes NV-7978 (#11462)

08 июн 2026, 09:17

08 июн 2026, 09:17c45762d

import {
  Body,
  ClassSerializerInterceptor,
  Controller,
  HttpCode,
  HttpStatus,
  Post,
  UseInterceptors,
} from '@nestjs/common';
import { ApiExcludeController, ApiOperation } from '@nestjs/swagger';
import { RequirePermissions } from '@novu/application-generic';
import { PermissionsEnum, UserSessionData } from '@novu/shared';
import { RequireAuthentication } from '../auth/framework/auth.decorator';
import { ApiCommonResponses, ApiResponse } from '../shared/framework/response.decorator';
import { UserSession } from '../shared/framework/user.decorator';
import { ClaimKeylessConnectRequestDto } from './dtos/claim-keyless-connect-request.dto';
import { ClaimKeylessConnectResponseDto } from './dtos/claim-keyless-connect-response.dto';
import { ClaimKeylessConnectCommand } from './usecases/claim-keyless-connect/claim-keyless-connect.command';
import { ClaimKeylessConnect } from './usecases/claim-keyless-connect/claim-keyless-connect.usecase';

@ApiCommonResponses()
@Controller('/connect')
@UseInterceptors(ClassSerializerInterceptor)
@ApiExcludeController()
@RequireAuthentication()
export class ConnectController {
  constructor(private readonly claimKeylessConnectUsecase: ClaimKeylessConnect) {}

  @Post('/claim')
  @RequirePermissions(PermissionsEnum.ENVIRONMENT_WRITE)
  @HttpCode(HttpStatus.OK)
  @ApiResponse(ClaimKeylessConnectResponseDto)
  @ApiOperation({
    summary: 'Claim a keyless connect session',
    description:
      'Merges the agent, channel integration, and conversation created during an anonymous keyless `novu connect` ' +
      'session into the authenticated user\u2019s Development environment, so the in-channel conversation continues ' +
      'under their account.',
  })
  async claim(
    @UserSession() user: UserSessionData,
    @Body() body: ClaimKeylessConnectRequestDto
  ): Promise<ClaimKeylessConnectResponseDto> {
    return this.claimKeylessConnectUsecase.execute(
      ClaimKeylessConnectCommand.create({
        userId: user._id,
        organizationId: user.organizationId,
        token: body.token,
      })
    );
  }
}