From 8e6227d9b46ffa5d72cb9715974b650d708744a6 Mon Sep 17 00:00:00 2001
From: wancat <wancat@wancat.cc>
Date: Wed, 1 Nov 2023 22:59:32 +0800
Subject: [PATCH] feat: add validation before creating session

---
 server/src/api/controllers/sessionController.js |  5 +++--
 server/src/api/routes/sessions.js               | 17 +++++++++++++++--
 server/src/api/validators/sessionValidator.js   |  8 ++++++++
 3 files changed, 26 insertions(+), 4 deletions(-)
 create mode 100644 server/src/api/validators/sessionValidator.js

diff --git a/server/src/api/controllers/sessionController.js b/server/src/api/controllers/sessionController.js
index 8bfe782..1fdbf32 100644
--- a/server/src/api/controllers/sessionController.js
+++ b/server/src/api/controllers/sessionController.js
@@ -1,3 +1,4 @@
+import { matchedData } from 'express-validator'
 import { Session } from '@linux-odyssey/models'
 import {
   createNewSession,
@@ -40,7 +41,7 @@ export async function getSessionList(req, res) {
 }
 
 export async function createSession(req, res) {
-  const { quest_id } = req.body
+  const { quest_id } = matchedData(req)
   try {
     const session = await createNewSession(req.user, quest_id)
     res.status(201).json(sessionDetail(session))
@@ -87,7 +88,7 @@ export async function deleteSessionById(req, res) {
 }
 
 export async function getOrCreateSession(req, res) {
-  const { quest_id } = req.body
+  const { quest_id } = matchedData(req)
   try {
     const session = await getOrCreateActiveSession(req.user, quest_id)
     res.json(sessionDetail(session))
diff --git a/server/src/api/routes/sessions.js b/server/src/api/routes/sessions.js
index 86961d5..aad0db8 100644
--- a/server/src/api/routes/sessions.js
+++ b/server/src/api/routes/sessions.js
@@ -1,12 +1,25 @@
 import { Router } from 'express'
 import * as sessionController from '../controllers/sessionController.js'
 import { sessionRateLimit } from '../../middleware/rateLimiter.js'
+import {
+  createSessionValidator,
+  activeSessionValidator,
+} from '../validators/sessionValidator.js'
 
 const router = Router()
 
 router.get('/', sessionController.getSessionList)
-router.post('/', sessionRateLimit, sessionController.createSession)
-router.post('/active', sessionController.getOrCreateSession)
+router.post(
+  '/',
+  createSessionValidator,
+  sessionRateLimit,
+  sessionController.createSession
+)
+router.post(
+  '/active',
+  activeSessionValidator,
+  sessionController.getOrCreateSession
+)
 router.get('/:id', sessionController.getSessionById)
 router.delete('/:id', sessionController.deleteSessionById)
 
diff --git a/server/src/api/validators/sessionValidator.js b/server/src/api/validators/sessionValidator.js
new file mode 100644
index 0000000..73a7bd2
--- /dev/null
+++ b/server/src/api/validators/sessionValidator.js
@@ -0,0 +1,8 @@
+import { check } from 'express-validator'
+import { noError } from '../../middleware/validator.js'
+
+const checkQuestId = () =>
+  check('quest_id').notEmpty().isString().isLowercase().isLength({ max: 64 })
+
+export const createSessionValidator = [checkQuestId(), noError]
+export const activeSessionValidator = [checkQuestId(), noError]