all

Securite/Linkwarden/lib/api/archiveHandler.ts

@@ -0,0 +1,411 @@
+import { LaunchOptions, chromium, devices } from "playwright";
+import { prisma } from "./db";
+import createFile from "./storage/createFile";
+import sendToWayback from "./sendToWayback";
+import { Readability } from "@mozilla/readability";
+import { JSDOM } from "jsdom";
+import DOMPurify from "dompurify";
+import { Collection, Link, User } from "@prisma/client";
+import validateUrlSize from "./validateUrlSize";
+import removeFile from "./storage/removeFile";
+import Jimp from "jimp";
+import createFolder from "./storage/createFolder";
+
+type LinksAndCollectionAndOwner = Link & {
+  collection: Collection & {
+    owner: User;
+  };
+};
+
+const BROWSER_TIMEOUT = Number(process.env.BROWSER_TIMEOUT) || 5;
+
+export default async function archiveHandler(link: LinksAndCollectionAndOwner) {
+  // allow user to configure a proxy
+  let browserOptions: LaunchOptions = {};
+  if (process.env.PROXY) {
+    browserOptions.proxy = {
+      server: process.env.PROXY,
+      bypass: process.env.PROXY_BYPASS,
+      username: process.env.PROXY_USERNAME,
+      password: process.env.PROXY_PASSWORD,
+    };
+  }
+
+  const browser = await chromium.launch(browserOptions);
+  const context = await browser.newContext({
+    ...devices["Desktop Chrome"],
+    ignoreHTTPSErrors: process.env.IGNORE_HTTPS_ERRORS === "true",
+  });
+
+  const page = await context.newPage();
+
+  const timeoutPromise = new Promise((_, reject) => {
+    setTimeout(
+      () =>
+        reject(
+          new Error(
+            `Browser has been open for more than ${BROWSER_TIMEOUT} minutes.`
+          )
+        ),
+      BROWSER_TIMEOUT * 60000
+    );
+  });
+
+  try {
+    await Promise.race([
+      (async () => {
+        const validatedUrl = link.url
+          ? await validateUrlSize(link.url)
+          : undefined;
+
+        if (validatedUrl === null)
+          throw "Something went wrong while retrieving the file size.";
+
+        const contentType = validatedUrl?.get("content-type");
+        let linkType = "url";
+        let imageExtension = "png";
+
+        if (!link.url) linkType = link.type;
+        else if (contentType?.includes("application/pdf")) linkType = "pdf";
+        else if (contentType?.startsWith("image")) {
+          linkType = "image";
+          if (contentType.includes("image/jpeg")) imageExtension = "jpeg";
+          else if (contentType.includes("image/png")) imageExtension = "png";
+        }
+
+        const user = link.collection?.owner;
+
+        // send to archive.org
+        if (user.archiveAsWaybackMachine && link.url) sendToWayback(link.url);
+
+        const targetLink = await prisma.link.update({
+          where: { id: link.id },
+          data: {
+            type: linkType,
+            image:
+              user.archiveAsScreenshot && !link.image?.startsWith("archive")
+                ? "pending"
+                : "unavailable",
+            pdf:
+              user.archiveAsPDF && !link.pdf?.startsWith("archive")
+                ? "pending"
+                : "unavailable",
+            readable: !link.readable?.startsWith("archive")
+              ? "pending"
+              : undefined,
+            preview: !link.readable?.startsWith("archive")
+              ? "pending"
+              : undefined,
+            lastPreserved: new Date().toISOString(),
+          },
+        });
+
+        if (linkType === "image" && !link.image?.startsWith("archive")) {
+          await imageHandler(link, imageExtension); // archive image (jpeg/png)
+          return;
+        } else if (linkType === "pdf" && !link.pdf?.startsWith("archive")) {
+          await pdfHandler(link); // archive pdf
+          return;
+        } else if (link.url) {
+          // archive url
+
+          await page.goto(link.url, { waitUntil: "domcontentloaded" });
+
+          const content = await page.content();
+
+          // TODO single file
+          // const session = await page.context().newCDPSession(page);
+          // const doc = await session.send("Page.captureSnapshot", {
+          //   format: "mhtml",
+          // });
+          // const saveDocLocally = (doc: any) => {
+          //   console.log(doc);
+          //   return createFile({
+          //     data: doc,
+          //     filePath: `archives/${targetLink.collectionId}/${link.id}.mhtml`,
+          //   });
+          // };
+          // saveDocLocally(doc.data);
+
+          // Readability
+          const window = new JSDOM("").window;
+          const purify = DOMPurify(window);
+          const cleanedUpContent = purify.sanitize(content);
+          const dom = new JSDOM(cleanedUpContent, { url: link.url || "" });
+          const article = new Readability(dom.window.document).parse();
+          const articleText = article?.textContent
+            .replace(/ +(?= )/g, "") // strip out multiple spaces
+            .replace(/(\r\n|\n|\r)/gm, " "); // strip out line breaks
+          if (
+            articleText &&
+            articleText !== "" &&
+            !link.readable?.startsWith("archive")
+          ) {
+            await createFile({
+              data: JSON.stringify(article),
+              filePath: `archives/${targetLink.collectionId}/${link.id}_readability.json`,
+            });
+
+            await prisma.link.update({
+              where: { id: link.id },
+              data: {
+                readable: `archives/${targetLink.collectionId}/${link.id}_readability.json`,
+                textContent: articleText,
+              },
+            });
+          }
+
+          // Preview
+
+          const ogImageUrl = await page.evaluate(() => {
+            const metaTag = document.querySelector('meta[property="og:image"]');
+            return metaTag ? (metaTag as any).content : null;
+          });
+
+          createFolder({
+            filePath: `archives/preview/${link.collectionId}`,
+          });
+
+          if (ogImageUrl) {
+            console.log("Found og:image URL:", ogImageUrl);
+
+            // Download the image
+            const imageResponse = await page.goto(ogImageUrl);
+
+            // Check if imageResponse is not null
+            if (imageResponse && !link.preview?.startsWith("archive")) {
+              const buffer = await imageResponse.body();
+
+              // Check if buffer is not null
+              if (buffer) {
+                // Load the image using Jimp
+                Jimp.read(buffer, async (err, image) => {
+                  if (image && !err) {
+                    image?.resize(1280, Jimp.AUTO).quality(20);
+                    const processedBuffer = await image?.getBufferAsync(
+                      Jimp.MIME_JPEG
+                    );
+
+                    createFile({
+                      data: processedBuffer,
+                      filePath: `archives/preview/${link.collectionId}/${link.id}.jpeg`,
+                    }).then(() => {
+                      return prisma.link.update({
+                        where: { id: link.id },
+                        data: {
+                          preview: `archives/preview/${link.collectionId}/${link.id}.jpeg`,
+                        },
+                      });
+                    });
+                  }
+                }).catch((err) => {
+                  console.error("Error processing the image:", err);
+                });
+              } else {
+                console.log("No image data found.");
+              }
+            }
+
+            await page.goBack();
+          } else if (!link.preview?.startsWith("archive")) {
+            console.log("No og:image found");
+            await page
+              .screenshot({ type: "jpeg", quality: 20 })
+              .then((screenshot) => {
+                return createFile({
+                  data: screenshot,
+                  filePath: `archives/preview/${link.collectionId}/${link.id}.jpeg`,
+                });
+              })
+              .then(() => {
+                return prisma.link.update({
+                  where: { id: link.id },
+                  data: {
+                    preview: `archives/preview/${link.collectionId}/${link.id}.jpeg`,
+                  },
+                });
+              });
+          }
+
+          // Screenshot/PDF
+          await page.evaluate(
+            autoScroll,
+            Number(process.env.AUTOSCROLL_TIMEOUT) || 30
+          );
+
+          // Check if the user hasn't deleted the link by the time we're done scrolling
+          const linkExists = await prisma.link.findUnique({
+            where: { id: link.id },
+          });
+          if (linkExists) {
+            const processingPromises = [];
+
+            if (
+              user.archiveAsScreenshot &&
+              !link.image?.startsWith("archive")
+            ) {
+              processingPromises.push(
+                page.screenshot({ fullPage: true }).then((screenshot) => {
+                  return createFile({
+                    data: screenshot,
+                    filePath: `archives/${linkExists.collectionId}/${link.id}.png`,
+                  });
+                })
+              );
+            }
+
+            // apply administrator's defined pdf margins or default to 15px
+            const margins = {
+              top: process.env.PDF_MARGIN_TOP || "15px",
+              bottom: process.env.PDF_MARGIN_BOTTOM || "15px",
+            };
+
+            if (user.archiveAsPDF && !link.pdf?.startsWith("archive")) {
+              processingPromises.push(
+                page
+                  .pdf({
+                    width: "1366px",
+                    height: "1931px",
+                    printBackground: true,
+                    margin: margins,
+                  })
+                  .then((pdf) => {
+                    return createFile({
+                      data: pdf,
+                      filePath: `archives/${linkExists.collectionId}/${link.id}.pdf`,
+                    });
+                  })
+              );
+            }
+            await Promise.allSettled(processingPromises);
+            await prisma.link.update({
+              where: { id: link.id },
+              data: {
+                image: user.archiveAsScreenshot
+                  ? `archives/${linkExists.collectionId}/${link.id}.png`
+                  : undefined,
+                pdf: user.archiveAsPDF
+                  ? `archives/${linkExists.collectionId}/${link.id}.pdf`
+                  : undefined,
+              },
+            });
+          }
+        }
+      })(),
+      timeoutPromise,
+    ]);
+  } catch (err) {
+    console.log(err);
+    console.log("Failed Link details:", link);
+    throw err;
+  } finally {
+    const finalLink = await prisma.link.findUnique({
+      where: { id: link.id },
+    });
+
+    if (finalLink)
+      await prisma.link.update({
+        where: { id: link.id },
+        data: {
+          lastPreserved: new Date().toISOString(),
+          readable: !finalLink.readable?.startsWith("archives")
+            ? "unavailable"
+            : undefined,
+          image: !finalLink.image?.startsWith("archives")
+            ? "unavailable"
+            : undefined,
+          pdf: !finalLink.pdf?.startsWith("archives")
+            ? "unavailable"
+            : undefined,
+          preview: !finalLink.preview?.startsWith("archives")
+            ? "unavailable"
+            : undefined,
+        },
+      });
+    else {
+      removeFile({ filePath: `archives/${link.collectionId}/${link.id}.png` });
+      removeFile({ filePath: `archives/${link.collectionId}/${link.id}.pdf` });
+      removeFile({
+        filePath: `archives/${link.collectionId}/${link.id}_readability.json`,
+      });
+      removeFile({
+        filePath: `archives/preview/${link.collectionId}/${link.id}.jpeg`,
+      });
+    }
+
+    await browser.close();
+  }
+}
+
+const autoScroll = async (AUTOSCROLL_TIMEOUT: number) => {
+  const timeoutPromise = new Promise<void>((_, reject) => {
+    setTimeout(() => {
+      reject(new Error(`Webpage was too long to be archived.`));
+    }, AUTOSCROLL_TIMEOUT * 1000);
+  });
+
+  const scrollingPromise = new Promise<void>((resolve) => {
+    let totalHeight = 0;
+    let distance = 100;
+    let scrollDown = setInterval(() => {
+      let scrollHeight = document.body.scrollHeight;
+      window.scrollBy(0, distance);
+      totalHeight += distance;
+      if (totalHeight >= scrollHeight) {
+        clearInterval(scrollDown);
+        window.scroll(0, 0);
+        resolve();
+      }
+    }, 100);
+  });
+
+  await Promise.race([scrollingPromise, timeoutPromise]);
+};
+
+const imageHandler = async ({ url, id }: Link, extension: string) => {
+  const image = await fetch(url as string).then((res) => res.blob());
+
+  const buffer = Buffer.from(await image.arrayBuffer());
+
+  const linkExists = await prisma.link.findUnique({
+    where: { id },
+  });
+
+  if (linkExists) {
+    await createFile({
+      data: buffer,
+      filePath: `archives/${linkExists.collectionId}/${id}.${extension}`,
+    });
+
+    await prisma.link.update({
+      where: { id },
+      data: {
+        image: `archives/${linkExists.collectionId}/${id}.${extension}`,
+      },
+    });
+  }
+};
+
+const pdfHandler = async ({ url, id }: Link) => {
+  const pdf = await fetch(url as string).then((res) => res.blob());
+
+  const buffer = Buffer.from(await pdf.arrayBuffer());
+
+  const linkExists = await prisma.link.findUnique({
+    where: { id },
+  });
+
+  if (linkExists) {
+    await createFile({
+      data: buffer,
+      filePath: `archives/${linkExists.collectionId}/${id}.pdf`,
+    });
+
+    await prisma.link.update({
+      where: { id },
+      data: {
+        pdf: `archives/${linkExists.collectionId}/${id}.pdf`,
+      },
+    });
+  }
+};

Securite/Linkwarden/lib/api/checkSubscriptionByEmail.ts

@@ -0,0 +1,53 @@
+import Stripe from "stripe";
+
+const MONTHLY_PRICE_ID = process.env.MONTHLY_PRICE_ID;
+const YEARLY_PRICE_ID = process.env.YEARLY_PRICE_ID;
+const STRIPE_SECRET_KEY = process.env.STRIPE_SECRET_KEY;
+
+export default async function checkSubscriptionByEmail(email: string) {
+  let active: boolean | undefined,
+    stripeSubscriptionId: string | undefined,
+    currentPeriodStart: number | undefined,
+    currentPeriodEnd: number | undefined;
+
+  if (!STRIPE_SECRET_KEY)
+    return {
+      active,
+      stripeSubscriptionId,
+      currentPeriodStart,
+      currentPeriodEnd,
+    };
+
+  const stripe = new Stripe(STRIPE_SECRET_KEY, {
+    apiVersion: "2022-11-15",
+  });
+
+  console.log("Request made to Stripe by:", email);
+  const listByEmail = await stripe.customers.list({
+    email: email.toLowerCase(),
+    expand: ["data.subscriptions"],
+  });
+
+  listByEmail.data.some((customer) => {
+    customer.subscriptions?.data.some((subscription) => {
+      subscription.current_period_end;
+
+      active =
+        subscription.items.data.some(
+          (e) =>
+            (e.price.id === MONTHLY_PRICE_ID && e.price.active === true) ||
+            (e.price.id === YEARLY_PRICE_ID && e.price.active === true)
+        ) || false;
+      stripeSubscriptionId = subscription.id;
+      currentPeriodStart = subscription.current_period_start * 1000;
+      currentPeriodEnd = subscription.current_period_end * 1000;
+    });
+  });
+
+  return {
+    active: active || false,
+    stripeSubscriptionId,
+    currentPeriodStart,
+    currentPeriodEnd,
+  };
+}

Securite/Linkwarden/lib/api/controllers/collections/collectionId/deleteCollectionById.ts

@@ -0,0 +1,129 @@
+import { prisma } from "@/lib/api/db";
+import getPermission from "@/lib/api/getPermission";
+import { Collection, UsersAndCollections } from "@prisma/client";
+import removeFolder from "@/lib/api/storage/removeFolder";
+
+export default async function deleteCollection(
+  userId: number,
+  collectionId: number
+) {
+  if (!collectionId)
+    return { response: "Please choose a valid collection.", status: 401 };
+
+  const collectionIsAccessible = await getPermission({
+    userId,
+    collectionId,
+  });
+
+  const memberHasAccess = collectionIsAccessible?.members.some(
+    (e: UsersAndCollections) => e.userId === userId
+  );
+
+  if (collectionIsAccessible?.ownerId !== userId && memberHasAccess) {
+    // Remove relation/Leave collection
+    const deletedUsersAndCollectionsRelation =
+      await prisma.usersAndCollections.delete({
+        where: {
+          userId_collectionId: {
+            userId: userId,
+            collectionId: collectionId,
+          },
+        },
+      });
+
+    await removeFromOrders(userId, collectionId);
+
+    return { response: deletedUsersAndCollectionsRelation, status: 200 };
+  } else if (collectionIsAccessible?.ownerId !== userId) {
+    return { response: "Collection is not accessible.", status: 401 };
+  }
+
+  const deletedCollection = await prisma.$transaction(async () => {
+    await deleteSubCollections(collectionId);
+
+    await prisma.usersAndCollections.deleteMany({
+      where: {
+        collection: {
+          id: collectionId,
+        },
+      },
+    });
+
+    await prisma.link.deleteMany({
+      where: {
+        collection: {
+          id: collectionId,
+        },
+      },
+    });
+
+    await removeFolder({ filePath: `archives/${collectionId}` });
+
+    await removeFromOrders(userId, collectionId);
+
+    return await prisma.collection.delete({
+      where: {
+        id: collectionId,
+      },
+    });
+  });
+
+  return { response: deletedCollection, status: 200 };
+}
+
+async function deleteSubCollections(collectionId: number) {
+  const subCollections = await prisma.collection.findMany({
+    where: { parentId: collectionId },
+  });
+
+  for (const subCollection of subCollections) {
+    await deleteSubCollections(subCollection.id);
+
+    await prisma.usersAndCollections.deleteMany({
+      where: {
+        collection: {
+          id: subCollection.id,
+        },
+      },
+    });
+
+    await prisma.link.deleteMany({
+      where: {
+        collection: {
+          id: subCollection.id,
+        },
+      },
+    });
+
+    await prisma.collection.delete({
+      where: { id: subCollection.id },
+    });
+
+    await removeFolder({ filePath: `archives/${subCollection.id}` });
+  }
+}
+
+async function removeFromOrders(userId: number, collectionId: number) {
+  const userCollectionOrder = await prisma.user.findUnique({
+    where: {
+      id: userId,
+    },
+    select: {
+      collectionOrder: true,
+    },
+  });
+
+  if (userCollectionOrder)
+    await prisma.user.update({
+      where: {
+        id: userId,
+      },
+      data: {
+        collectionOrder: {
+          set: userCollectionOrder.collectionOrder.filter(
+            (e: number) => e !== collectionId
+          ),
+        },
+      },
+    });
+}

Securite/Linkwarden/lib/api/controllers/collections/collectionId/getCollectionById.ts

@@ -0,0 +1,34 @@
+import { prisma } from "@/lib/api/db";
+
+export default async function getCollectionById(
+  userId: number,
+  collectionId: number
+) {
+  const collections = await prisma.collection.findFirst({
+    where: {
+      id: collectionId,
+      OR: [
+        { ownerId: userId },
+        { members: { some: { user: { id: userId } } } },
+      ],
+    },
+    include: {
+      _count: {
+        select: { links: true },
+      },
+      members: {
+        include: {
+          user: {
+            select: {
+              username: true,
+              name: true,
+              image: true,
+            },
+          },
+        },
+      },
+    },
+  });
+
+  return { response: collections, status: 200 };
+}

Securite/Linkwarden/lib/api/controllers/collections/collectionId/updateCollectionById.ts

@@ -0,0 +1,107 @@
+import { prisma } from "@/lib/api/db";
+import { CollectionIncludingMembersAndLinkCount } from "@/types/global";
+import getPermission from "@/lib/api/getPermission";
+
+export default async function updateCollection(
+  userId: number,
+  collectionId: number,
+  data: CollectionIncludingMembersAndLinkCount
+) {
+  if (!collectionId)
+    return { response: "Please choose a valid collection.", status: 401 };
+
+  const collectionIsAccessible = await getPermission({
+    userId,
+    collectionId,
+  });
+
+  if (!(collectionIsAccessible?.ownerId === userId))
+    return { response: "Collection is not accessible.", status: 401 };
+
+  console.log(data);
+
+  if (data.parentId) {
+    if (data.parentId !== ("root" as any)) {
+      const findParentCollection = await prisma.collection.findUnique({
+        where: {
+          id: data.parentId,
+        },
+        select: {
+          ownerId: true,
+          parentId: true,
+        },
+      });
+
+      if (
+        findParentCollection?.ownerId !== userId ||
+        typeof data.parentId !== "number" ||
+        findParentCollection?.parentId === data.parentId
+      )
+        return {
+          response: "You are not authorized to create a sub-collection here.",
+          status: 403,
+        };
+    }
+  }
+
+  const updatedCollection = await prisma.$transaction(async () => {
+    await prisma.usersAndCollections.deleteMany({
+      where: {
+        collection: {
+          id: collectionId,
+        },
+      },
+    });
+
+    return await prisma.collection.update({
+      where: {
+        id: collectionId,
+      },
+      data: {
+        name: data.name.trim(),
+        description: data.description,
+        color: data.color,
+        isPublic: data.isPublic,
+        parent:
+          data.parentId && data.parentId !== ("root" as any)
+            ? {
+                connect: {
+                  id: data.parentId,
+                },
+              }
+            : data.parentId === ("root" as any)
+              ? {
+                  disconnect: true,
+                }
+              : undefined,
+        members: {
+          create: data.members.map((e) => ({
+            user: { connect: { id: e.user.id || e.userId } },
+            canCreate: e.canCreate,
+            canUpdate: e.canUpdate,
+            canDelete: e.canDelete,
+          })),
+        },
+      },
+      include: {
+        _count: {
+          select: { links: true },
+        },
+        members: {
+          include: {
+            user: {
+              select: {
+                image: true,
+                username: true,
+                name: true,
+                id: true,
+              },
+            },
+          },
+        },
+      },
+    });
+  });
+
+  return { response: updatedCollection, status: 200 };
+}

Securite/Linkwarden/lib/api/controllers/collections/getCollections.ts

@@ -0,0 +1,36 @@
+import { prisma } from "@/lib/api/db";
+
+export default async function getCollection(userId: number) {
+  const collections = await prisma.collection.findMany({
+    where: {
+      OR: [
+        { ownerId: userId },
+        { members: { some: { user: { id: userId } } } },
+      ],
+    },
+    include: {
+      _count: {
+        select: { links: true },
+      },
+      parent: {
+        select: {
+          id: true,
+          name: true,
+        },
+      },
+      members: {
+        include: {
+          user: {
+            select: {
+              username: true,
+              name: true,
+              image: true,
+            },
+          },
+        },
+      },
+    },
+  });
+
+  return { response: collections, status: 200 };
+}

Securite/Linkwarden/lib/api/controllers/collections/postCollection.ts

@@ -0,0 +1,84 @@
+import { prisma } from "@/lib/api/db";
+import { CollectionIncludingMembersAndLinkCount } from "@/types/global";
+import createFolder from "@/lib/api/storage/createFolder";
+
+export default async function postCollection(
+  collection: CollectionIncludingMembersAndLinkCount,
+  userId: number
+) {
+  if (!collection || collection.name.trim() === "")
+    return {
+      response: "Please enter a valid collection.",
+      status: 400,
+    };
+
+  if (collection.parentId) {
+    const findParentCollection = await prisma.collection.findUnique({
+      where: {
+        id: collection.parentId,
+      },
+      select: {
+        ownerId: true,
+      },
+    });
+
+    if (
+      findParentCollection?.ownerId !== userId ||
+      typeof collection.parentId !== "number"
+    )
+      return {
+        response: "You are not authorized to create a sub-collection here.",
+        status: 403,
+      };
+  }
+
+  const newCollection = await prisma.collection.create({
+    data: {
+      owner: {
+        connect: {
+          id: userId,
+        },
+      },
+      name: collection.name.trim(),
+      description: collection.description,
+      color: collection.color,
+      parent: collection.parentId
+        ? {
+            connect: {
+              id: collection.parentId,
+            },
+          }
+        : undefined,
+    },
+    include: {
+      _count: {
+        select: { links: true },
+      },
+      members: {
+        include: {
+          user: {
+            select: {
+              username: true,
+              name: true,
+            },
+          },
+        },
+      },
+    },
+  });
+
+  await prisma.user.update({
+    where: {
+      id: userId,
+    },
+    data: {
+      collectionOrder: {
+        push: newCollection.id,
+      },
+    },
+  });
+
+  createFolder({ filePath: `archives/${newCollection.id}` });
+
+  return { response: newCollection, status: 200 };
+}

Securite/Linkwarden/lib/api/controllers/dashboard/getDashboardData.ts

@@ -0,0 +1,78 @@
+import { prisma } from "@/lib/api/db";
+import { LinkRequestQuery, Sort } from "@/types/global";
+
+export default async function getDashboardData(
+  userId: number,
+  query: LinkRequestQuery
+) {
+  let order: any;
+  if (query.sort === Sort.DateNewestFirst) order = { id: "desc" };
+  else if (query.sort === Sort.DateOldestFirst) order = { id: "asc" };
+  else if (query.sort === Sort.NameAZ) order = { name: "asc" };
+  else if (query.sort === Sort.NameZA) order = { name: "desc" };
+  else if (query.sort === Sort.DescriptionAZ) order = { description: "asc" };
+  else if (query.sort === Sort.DescriptionZA) order = { description: "desc" };
+
+  const pinnedLinks = await prisma.link.findMany({
+    take: 8,
+    where: {
+      AND: [
+        {
+          collection: {
+            OR: [
+              { ownerId: userId },
+              {
+                members: {
+                  some: { userId },
+                },
+              },
+            ],
+          },
+        },
+        {
+          pinnedBy: { some: { id: userId } },
+        },
+      ],
+    },
+    include: {
+      tags: true,
+      collection: true,
+      pinnedBy: {
+        where: { id: userId },
+        select: { id: true },
+      },
+    },
+    orderBy: order || { id: "desc" },
+  });
+
+  const recentlyAddedLinks = await prisma.link.findMany({
+    take: 8,
+    where: {
+      collection: {
+        OR: [
+          { ownerId: userId },
+          {
+            members: {
+              some: { userId },
+            },
+          },
+        ],
+      },
+    },
+    include: {
+      tags: true,
+      collection: true,
+      pinnedBy: {
+        where: { id: userId },
+        select: { id: true },
+      },
+    },
+    orderBy: order || { id: "desc" },
+  });
+
+  const links = [...recentlyAddedLinks, ...pinnedLinks].sort(
+    (a, b) => (new Date(b.id) as any) - (new Date(a.id) as any)
+  );
+
+  return { response: links, status: 200 };
+}

Securite/Linkwarden/lib/api/controllers/links/bulk/deleteLinksById.ts

@@ -0,0 +1,58 @@
+import { prisma } from "@/lib/api/db";
+import { UsersAndCollections } from "@prisma/client";
+import getPermission from "@/lib/api/getPermission";
+import removeFile from "@/lib/api/storage/removeFile";
+
+export default async function deleteLinksById(
+  userId: number,
+  linkIds: number[]
+) {
+  if (!linkIds || linkIds.length === 0) {
+    return { response: "Please choose valid links.", status: 401 };
+  }
+
+  const collectionIsAccessibleArray = [];
+
+  // Check if the user has access to the collection of each link
+  // if any of the links are not accessible, return an error
+  // if all links are accessible, continue with the deletion
+  // and add the collection to the collectionIsAccessibleArray
+  for (const linkId of linkIds) {
+    const collectionIsAccessible = await getPermission({ userId, linkId });
+
+    const memberHasAccess = collectionIsAccessible?.members.some(
+      (e: UsersAndCollections) => e.userId === userId && e.canDelete
+    );
+
+    if (!(collectionIsAccessible?.ownerId === userId || memberHasAccess)) {
+      return { response: "Collection is not accessible.", status: 401 };
+    }
+
+    collectionIsAccessibleArray.push(collectionIsAccessible);
+  }
+
+  const deletedLinks = await prisma.link.deleteMany({
+    where: {
+      id: { in: linkIds },
+    },
+  });
+
+  // Loop through each link and delete the associated files
+  // if the user has access to the collection
+  for (let i = 0; i < linkIds.length; i++) {
+    const linkId = linkIds[i];
+    const collectionIsAccessible = collectionIsAccessibleArray[i];
+
+    removeFile({
+      filePath: `archives/${collectionIsAccessible?.id}/${linkId}.pdf`,
+    });
+    removeFile({
+      filePath: `archives/${collectionIsAccessible?.id}/${linkId}.png`,
+    });
+    removeFile({
+      filePath: `archives/${collectionIsAccessible?.id}/${linkId}_readability.json`,
+    });
+  }
+
+  return { response: deletedLinks, status: 200 };
+}

Securite/Linkwarden/lib/api/controllers/links/bulk/updateLinks.ts

@@ -0,0 +1,50 @@
+import { LinkIncludingShortenedCollectionAndTags } from "@/types/global";
+import updateLinkById from "../linkId/updateLinkById";
+
+export default async function updateLinks(
+  userId: number,
+  links: LinkIncludingShortenedCollectionAndTags[],
+  removePreviousTags: boolean,
+  newData: Pick<
+    LinkIncludingShortenedCollectionAndTags,
+    "tags" | "collectionId"
+  >
+) {
+  let allUpdatesSuccessful = true;
+
+  // Have to use a loop here rather than updateMany, see the following:
+  // https://github.com/prisma/prisma/issues/3143
+  for (const link of links) {
+    let updatedTags = [...link.tags, ...(newData.tags ?? [])];
+
+    if (removePreviousTags) {
+      // If removePreviousTags is true, replace the existing tags with new tags
+      updatedTags = [...(newData.tags ?? [])];
+    }
+
+    const updatedData: LinkIncludingShortenedCollectionAndTags = {
+      ...link,
+      tags: updatedTags,
+      collection: {
+        ...link.collection,
+        id: newData.collectionId ?? link.collection.id,
+      },
+    };
+
+    const updatedLink = await updateLinkById(
+      userId,
+      link.id as number,
+      updatedData
+    );
+
+    if (updatedLink.status !== 200) {
+      allUpdatesSuccessful = false;
+    }
+  }
+
+  if (allUpdatesSuccessful) {
+    return { response: "All links updated successfully", status: 200 };
+  } else {
+    return { response: "Some links failed to update", status: 400 };
+  }
+}

Securite/Linkwarden/lib/api/controllers/links/getLinks.ts

@@ -0,0 +1,152 @@
+import { prisma } from "@/lib/api/db";
+import { LinkRequestQuery, Sort } from "@/types/global";
+
+export default async function getLink(userId: number, query: LinkRequestQuery) {
+  const POSTGRES_IS_ENABLED = process.env.DATABASE_URL.startsWith("postgresql");
+
+  let order: any;
+  if (query.sort === Sort.DateNewestFirst) order = { id: "desc" };
+  else if (query.sort === Sort.DateOldestFirst) order = { id: "asc" };
+  else if (query.sort === Sort.NameAZ) order = { name: "asc" };
+  else if (query.sort === Sort.NameZA) order = { name: "desc" };
+  else if (query.sort === Sort.DescriptionAZ) order = { description: "asc" };
+  else if (query.sort === Sort.DescriptionZA) order = { description: "desc" };
+
+  const searchConditions = [];
+
+  if (query.searchQueryString) {
+    if (query.searchByName) {
+      searchConditions.push({
+        name: {
+          contains: query.searchQueryString,
+          mode: POSTGRES_IS_ENABLED ? "insensitive" : undefined,
+        },
+      });
+    }
+
+    if (query.searchByUrl) {
+      searchConditions.push({
+        url: {
+          contains: query.searchQueryString,
+          mode: POSTGRES_IS_ENABLED ? "insensitive" : undefined,
+        },
+      });
+    }
+
+    if (query.searchByDescription) {
+      searchConditions.push({
+        description: {
+          contains: query.searchQueryString,
+          mode: POSTGRES_IS_ENABLED ? "insensitive" : undefined,
+        },
+      });
+    }
+
+    if (query.searchByTextContent) {
+      searchConditions.push({
+        textContent: {
+          contains: query.searchQueryString,
+          mode: POSTGRES_IS_ENABLED ? "insensitive" : undefined,
+        },
+      });
+    }
+
+    if (query.searchByTags) {
+      searchConditions.push({
+        tags: {
+          some: {
+            name: {
+              contains: query.searchQueryString,
+              mode: POSTGRES_IS_ENABLED ? "insensitive" : undefined,
+            },
+            OR: [
+              { ownerId: userId },
+              {
+                links: {
+                  some: {
+                    collection: {
+                      members: {
+                        some: { userId },
+                      },
+                    },
+                  },
+                },
+              },
+            ],
+          },
+        },
+      });
+    }
+  }
+
+  const tagCondition = [];
+
+  if (query.tagId) {
+    tagCondition.push({
+      tags: {
+        some: {
+          id: query.tagId,
+        },
+      },
+    });
+  }
+
+  const collectionCondition = [];
+
+  if (query.collectionId) {
+    collectionCondition.push({
+      collection: {
+        id: query.collectionId,
+      },
+    });
+  }
+
+  const links = await prisma.link.findMany({
+    take: Number(process.env.PAGINATION_TAKE_COUNT) || 20,
+    skip: query.cursor ? 1 : undefined,
+    cursor: query.cursor ? { id: query.cursor } : undefined,
+    where: {
+      AND: [
+        {
+          collection: {
+            OR: [
+              { ownerId: userId },
+              {
+                members: {
+                  some: { userId },
+                },
+              },
+            ],
+          },
+        },
+        ...collectionCondition,
+        {
+          OR: [
+            ...tagCondition,
+            {
+              [query.searchQueryString ? "OR" : "AND"]: [
+                {
+                  pinnedBy: query.pinnedOnly
+                    ? { some: { id: userId } }
+                    : undefined,
+                },
+                ...searchConditions,
+              ],
+            },
+          ],
+        },
+      ],
+    },
+    include: {
+      tags: true,
+      collection: true,
+      pinnedBy: {
+        where: { id: userId },
+        select: { id: true },
+      },
+    },
+    orderBy: order || { id: "desc" },
+  });
+
+  return { response: links, status: 200 };
+}

Securite/Linkwarden/lib/api/controllers/links/linkId/deleteLinkById.ts

@@ -0,0 +1,35 @@
+import { prisma } from "@/lib/api/db";
+import { Link, UsersAndCollections } from "@prisma/client";
+import getPermission from "@/lib/api/getPermission";
+import removeFile from "@/lib/api/storage/removeFile";
+
+export default async function deleteLink(userId: number, linkId: number) {
+  if (!linkId) return { response: "Please choose a valid link.", status: 401 };
+
+  const collectionIsAccessible = await getPermission({ userId, linkId });
+
+  const memberHasAccess = collectionIsAccessible?.members.some(
+    (e: UsersAndCollections) => e.userId === userId && e.canDelete
+  );
+
+  if (!(collectionIsAccessible?.ownerId === userId || memberHasAccess))
+    return { response: "Collection is not accessible.", status: 401 };
+
+  const deleteLink: Link = await prisma.link.delete({
+    where: {
+      id: linkId,
+    },
+  });
+
+  removeFile({
+    filePath: `archives/${collectionIsAccessible?.id}/${linkId}.pdf`,
+  });
+  removeFile({
+    filePath: `archives/${collectionIsAccessible?.id}/${linkId}.png`,
+  });
+  removeFile({
+    filePath: `archives/${collectionIsAccessible?.id}/${linkId}_readability.json`,
+  });
+
+  return { response: deleteLink, status: 200 };
+}

Securite/Linkwarden/lib/api/controllers/links/linkId/getLinkById.ts

@@ -0,0 +1,44 @@
+import { prisma } from "@/lib/api/db";
+import { Collection, UsersAndCollections } from "@prisma/client";
+import getPermission from "@/lib/api/getPermission";
+
+export default async function getLinkById(userId: number, linkId: number) {
+  if (!linkId)
+    return {
+      response: "Please choose a valid link.",
+      status: 401,
+    };
+
+  const collectionIsAccessible = await getPermission({ userId, linkId });
+
+  const memberHasAccess = collectionIsAccessible?.members.some(
+    (e: UsersAndCollections) => e.userId === userId
+  );
+
+  const isCollectionOwner = collectionIsAccessible?.ownerId === userId;
+
+  if (collectionIsAccessible?.ownerId !== userId && !memberHasAccess)
+    return {
+      response: "Collection is not accessible.",
+      status: 401,
+    };
+  else {
+    const link = await prisma.link.findUnique({
+      where: {
+        id: linkId,
+      },
+      include: {
+        tags: true,
+        collection: true,
+        pinnedBy: isCollectionOwner
+          ? {
+              where: { id: userId },
+              select: { id: true },
+            }
+          : undefined,
+      },
+    });
+
+    return { response: link, status: 200 };
+  }
+}

Securite/Linkwarden/lib/api/controllers/links/linkId/updateLinkById.ts

@@ -0,0 +1,167 @@
+import { prisma } from "@/lib/api/db";
+import { LinkIncludingShortenedCollectionAndTags } from "@/types/global";
+import { UsersAndCollections } from "@prisma/client";
+import getPermission from "@/lib/api/getPermission";
+import moveFile from "@/lib/api/storage/moveFile";
+
+export default async function updateLinkById(
+  userId: number,
+  linkId: number,
+  data: LinkIncludingShortenedCollectionAndTags
+) {
+  if (!data || !data.collection.id)
+    return {
+      response: "Please choose a valid link and collection.",
+      status: 401,
+    };
+
+  const collectionIsAccessible = await getPermission({ userId, linkId });
+
+  const isCollectionOwner =
+    collectionIsAccessible?.ownerId === data.collection.ownerId &&
+    data.collection.ownerId === userId;
+
+  const canPinPermission = collectionIsAccessible?.members.some(
+    (e: UsersAndCollections) => e.userId === userId
+  );
+
+  // If the user is able to create a link, they can pin it to their dashboard only.
+  if (canPinPermission) {
+    const updatedLink = await prisma.link.update({
+      where: {
+        id: linkId,
+      },
+      data: {
+        pinnedBy:
+          data?.pinnedBy && data.pinnedBy[0]
+            ? { connect: { id: userId } }
+            : { disconnect: { id: userId } },
+      },
+      include: {
+        collection: true,
+        pinnedBy: isCollectionOwner
+          ? {
+              where: { id: userId },
+              select: { id: true },
+            }
+          : undefined,
+      },
+    });
+
+    return { response: updatedLink, status: 200 };
+  }
+
+  const targetCollectionIsAccessible = await getPermission({
+    userId,
+    collectionId: data.collection.id,
+  });
+
+  const memberHasAccess = collectionIsAccessible?.members.some(
+    (e: UsersAndCollections) => e.userId === userId && e.canUpdate
+  );
+
+  const targetCollectionsAccessible =
+    targetCollectionIsAccessible?.ownerId === userId;
+
+  const targetCollectionMatchesData = data.collection.id
+    ? data.collection.id === targetCollectionIsAccessible?.id
+    : true && data.collection.name
+      ? data.collection.name === targetCollectionIsAccessible?.name
+      : true && data.collection.ownerId
+        ? data.collection.ownerId === targetCollectionIsAccessible?.ownerId
+        : true;
+
+  if (!targetCollectionsAccessible)
+    return {
+      response: "Target collection is not accessible.",
+      status: 401,
+    };
+  else if (!targetCollectionMatchesData)
+    return {
+      response: "Target collection does not match the data.",
+      status: 401,
+    };
+
+  const unauthorizedSwitchCollection =
+    !isCollectionOwner && collectionIsAccessible?.id !== data.collection.id;
+
+  // Makes sure collection members (non-owners) cannot move a link to/from a collection.
+  if (unauthorizedSwitchCollection)
+    return {
+      response: "You can't move a link to/from a collection you don't own.",
+      status: 401,
+    };
+  else if (collectionIsAccessible?.ownerId !== userId && !memberHasAccess)
+    return {
+      response: "Collection is not accessible.",
+      status: 401,
+    };
+  else {
+    const updatedLink = await prisma.link.update({
+      where: {
+        id: linkId,
+      },
+      data: {
+        name: data.name,
+        description: data.description,
+        collection: {
+          connect: {
+            id: data.collection.id,
+          },
+        },
+        tags: {
+          set: [],
+          connectOrCreate: data.tags.map((tag) => ({
+            where: {
+              name_ownerId: {
+                name: tag.name,
+                ownerId: data.collection.ownerId,
+              },
+            },
+            create: {
+              name: tag.name,
+              owner: {
+                connect: {
+                  id: data.collection.ownerId,
+                },
+              },
+            },
+          })),
+        },
+        pinnedBy:
+          data?.pinnedBy && data.pinnedBy[0]
+            ? { connect: { id: userId } }
+            : { disconnect: { id: userId } },
+      },
+      include: {
+        tags: true,
+        collection: true,
+        pinnedBy: isCollectionOwner
+          ? {
+              where: { id: userId },
+              select: { id: true },
+            }
+          : undefined,
+      },
+    });
+
+    if (collectionIsAccessible?.id !== data.collection.id) {
+      await moveFile(
+        `archives/${collectionIsAccessible?.id}/${linkId}.pdf`,
+        `archives/${data.collection.id}/${linkId}.pdf`
+      );
+
+      await moveFile(
+        `archives/${collectionIsAccessible?.id}/${linkId}.png`,
+        `archives/${data.collection.id}/${linkId}.png`
+      );
+
+      await moveFile(
+        `archives/${collectionIsAccessible?.id}/${linkId}_readability.json`,
+        `archives/${data.collection.id}/${linkId}_readability.json`
+      );
+    }
+
+    return { response: updatedLink, status: 200 };
+  }
+}

Securite/Linkwarden/lib/api/controllers/links/postLink.ts

@@ -0,0 +1,209 @@
+import { prisma } from "@/lib/api/db";
+import { LinkIncludingShortenedCollectionAndTags } from "@/types/global";
+import getTitle from "@/lib/shared/getTitle";
+import { UsersAndCollections } from "@prisma/client";
+import getPermission from "@/lib/api/getPermission";
+import createFolder from "@/lib/api/storage/createFolder";
+import validateUrlSize from "../../validateUrlSize";
+
+const MAX_LINKS_PER_USER = Number(process.env.MAX_LINKS_PER_USER) || 30000;
+
+export default async function postLink(
+  link: LinkIncludingShortenedCollectionAndTags,
+  userId: number
+) {
+  try {
+    new URL(link.url || "");
+  } catch (error) {
+    return {
+      response:
+        "Please enter a valid Address for the Link. (It should start with http/https)",
+      status: 400,
+    };
+  }
+
+  if (!link.collection.id && link.collection.name) {
+    link.collection.name = link.collection.name.trim();
+
+    // find the collection with the name and the user's id
+    const findCollection = await prisma.collection.findFirst({
+      where: {
+        name: link.collection.name,
+        ownerId: userId,
+        parentId: link.collection.parentId,
+      },
+    });
+
+    if (findCollection) {
+      const collectionIsAccessible = await getPermission({
+        userId,
+        collectionId: findCollection.id,
+      });
+
+      const memberHasAccess = collectionIsAccessible?.members.some(
+        (e: UsersAndCollections) => e.userId === userId && e.canCreate
+      );
+
+      if (!(collectionIsAccessible?.ownerId === userId || memberHasAccess))
+        return { response: "Collection is not accessible.", status: 401 };
+
+      link.collection.id = findCollection.id;
+      link.collection.ownerId = findCollection.ownerId;
+    } else {
+      const collection = await prisma.collection.create({
+        data: {
+          name: link.collection.name,
+          ownerId: userId,
+        },
+      });
+
+      link.collection.id = collection.id;
+
+      await prisma.user.update({
+        where: {
+          id: userId,
+        },
+        data: {
+          collectionOrder: {
+            push: link.collection.id,
+          },
+        },
+      });
+    }
+  } else if (link.collection.id) {
+    const collectionIsAccessible = await getPermission({
+      userId,
+      collectionId: link.collection.id,
+    });
+
+    const memberHasAccess = collectionIsAccessible?.members.some(
+      (e: UsersAndCollections) => e.userId === userId && e.canCreate
+    );
+
+    if (!(collectionIsAccessible?.ownerId === userId || memberHasAccess))
+      return { response: "Collection is not accessible.", status: 401 };
+  } else if (!link.collection.id) {
+    link.collection.name = "Unorganized";
+    link.collection.parentId = null;
+
+    // find the collection with the name "Unorganized" and the user's id
+    const unorganizedCollection = await prisma.collection.findFirst({
+      where: {
+        name: "Unorganized",
+        ownerId: userId,
+      },
+    });
+
+    link.collection.id = unorganizedCollection?.id;
+
+    await prisma.user.update({
+      where: {
+        id: userId,
+      },
+      data: {
+        collectionOrder: {
+          push: link.collection.id,
+        },
+      },
+    });
+  } else {
+    return { response: "Uncaught error.", status: 500 };
+  }
+
+  const user = await prisma.user.findUnique({
+    where: {
+      id: userId,
+    },
+  });
+
+  if (user?.preventDuplicateLinks) {
+    const existingLink = await prisma.link.findFirst({
+      where: {
+        url: link.url?.trim(),
+        collection: {
+          ownerId: userId,
+        },
+      },
+    });
+
+    if (existingLink)
+      return {
+        response: "Link already exists",
+        status: 409,
+      };
+  }
+
+  const numberOfLinksTheUserHas = await prisma.link.count({
+    where: {
+      collection: {
+        ownerId: userId,
+      },
+    },
+  });
+
+  if (numberOfLinksTheUserHas + 1 > MAX_LINKS_PER_USER)
+    return {
+      response: `Error: Each user can only have a maximum of ${MAX_LINKS_PER_USER} Links.`,
+      status: 400,
+    };
+
+  link.collection.name = link.collection.name.trim();
+
+  const description =
+    link.description && link.description !== ""
+      ? link.description
+      : link.url
+        ? await getTitle(link.url)
+        : undefined;
+
+  const validatedUrl = link.url ? await validateUrlSize(link.url) : undefined;
+
+  const contentType = validatedUrl?.get("content-type");
+  let linkType = "url";
+  let imageExtension = "png";
+
+  if (!link.url) linkType = link.type;
+  else if (contentType === "application/pdf") linkType = "pdf";
+  else if (contentType?.startsWith("image")) {
+    linkType = "image";
+    if (contentType === "image/jpeg") imageExtension = "jpeg";
+    else if (contentType === "image/png") imageExtension = "png";
+  }
+
+  const newLink = await prisma.link.create({
+    data: {
+      url: link.url?.trim(),
+      name: link.name,
+      description,
+      type: linkType,
+      collection: {
+        connect: {
+          id: link.collection.id,
+        },
+      },
+      tags: {
+        connectOrCreate: link.tags.map((tag) => ({
+          where: {
+            name_ownerId: {
+              name: tag.name.trim(),
+              ownerId: link.collection.ownerId,
+            },
+          },
+          create: {
+            name: tag.name.trim(),
+            owner: {
+              connect: {
+                id: link.collection.ownerId,
+              },
+            },
+          },
+        })),
+      },
+    },
+    include: { tags: true, collection: true },
+  });
+
+  createFolder({ filePath: `archives/${newLink.collectionId}` });
+
+  return { response: newLink, status: 200 };
+}

Securite/Linkwarden/lib/api/controllers/migration/exportData.ts

@@ -0,0 +1,39 @@
+import { prisma } from "@/lib/api/db";
+
+export default async function exportData(userId: number) {
+  const user = await prisma.user.findUnique({
+    where: { id: userId },
+    include: {
+      collections: {
+        include: {
+          links: {
+            include: {
+              tags: true,
+            },
+          },
+        },
+      },
+      pinnedLinks: true,
+      whitelistedUsers: true,
+    },
+  });
+
+  if (!user) return { response: "User not found.", status: 404 };
+
+  const { password, id, ...userData } = user;
+
+  function redactIds(obj: any) {
+    if (Array.isArray(obj)) {
+      obj.forEach((o) => redactIds(o));
+    } else if (obj !== null && typeof obj === "object") {
+      delete obj.id;
+      for (let key in obj) {
+        redactIds(obj[key]);
+      }
+    }
+  }
+
+  redactIds(userData);
+
+  return { response: userData, status: 200 };
+}

Securite/Linkwarden/lib/api/controllers/migration/importFromHTMLFile.ts

@@ -0,0 +1,266 @@
+import { prisma } from "@/lib/api/db";
+import createFolder from "@/lib/api/storage/createFolder";
+import { JSDOM } from "jsdom";
+import { parse, Node, Element, TextNode } from "himalaya";
+import { writeFileSync } from "fs";
+
+const MAX_LINKS_PER_USER = Number(process.env.MAX_LINKS_PER_USER) || 30000;
+
+export default async function importFromHTMLFile(
+  userId: number,
+  rawData: string
+) {
+  const dom = new JSDOM(rawData);
+  const document = dom.window.document;
+
+  // remove bad tags
+  document.querySelectorAll("meta").forEach((e) => (e.outerHTML = e.innerHTML));
+  document.querySelectorAll("META").forEach((e) => (e.outerHTML = e.innerHTML));
+  document.querySelectorAll("P").forEach((e) => (e.outerHTML = e.innerHTML));
+
+  const bookmarks = document.querySelectorAll("A");
+  const totalImports = bookmarks.length;
+
+  const numberOfLinksTheUserHas = await prisma.link.count({
+    where: {
+      collection: {
+        ownerId: userId,
+      },
+    },
+  });
+
+  if (totalImports + numberOfLinksTheUserHas > MAX_LINKS_PER_USER)
+    return {
+      response: `Error: Each user can only have a maximum of ${MAX_LINKS_PER_USER} Links.`,
+      status: 400,
+    };
+
+  const jsonData = parse(document.documentElement.outerHTML);
+
+  const processedArray = processNodes(jsonData);
+
+  for (const item of processedArray) {
+    console.log(item);
+    await processBookmarks(userId, item as Element);
+  }
+
+  return { response: "Success.", status: 200 };
+}
+
+async function processBookmarks(
+  userId: number,
+  data: Node,
+  parentCollectionId?: number
+) {
+  if (data.type === "element") {
+    for (const item of data.children) {
+      if (item.type === "element" && item.tagName === "dt") {
+        // process collection or sub-collection
+
+        let collectionId;
+        const collectionName = item.children.find(
+          (e) => e.type === "element" && e.tagName === "h3"
+        ) as Element;
+
+        if (collectionName) {
+          collectionId = await createCollection(
+            userId,
+            (collectionName.children[0] as TextNode).content,
+            parentCollectionId
+          );
+        }
+        await processBookmarks(
+          userId,
+          item,
+          collectionId || parentCollectionId
+        );
+      } else if (item.type === "element" && item.tagName === "a") {
+        // process link
+
+        const linkUrl = item?.attributes.find(
+          (e) => e.key.toLowerCase() === "href"
+        )?.value;
+        const linkName = (
+          item?.children.find((e) => e.type === "text") as TextNode
+        )?.content;
+        const linkTags = item?.attributes
+          .find((e) => e.key === "tags")
+          ?.value.split(",");
+
+        // set date if available
+        const linkDateValue = item?.attributes.find(
+          (e) => e.key.toLowerCase() === "add_date"
+        )?.value;
+
+        const linkDate = linkDateValue
+          ? new Date(Number(linkDateValue) * 1000)
+          : undefined;
+
+        let linkDesc =
+          (
+            (
+              item?.children?.find(
+                (e) => e.type === "element" && e.tagName === "dd"
+              ) as Element
+            )?.children[0] as TextNode
+          )?.content || "";
+
+        if (linkUrl && parentCollectionId) {
+          await createLink(
+            userId,
+            linkUrl,
+            parentCollectionId,
+            linkName,
+            linkDesc,
+            linkTags,
+            linkDate
+          );
+        } else if (linkUrl) {
+          // create a collection named "Imported Bookmarks" and add the link to it
+          const collectionId = await createCollection(userId, "Imports");
+
+          await createLink(
+            userId,
+            linkUrl,
+            collectionId,
+            linkName,
+            linkDesc,
+            linkTags,
+            linkDate
+          );
+        }
+
+        await processBookmarks(userId, item, parentCollectionId);
+      } else {
+        // process anything else
+        await processBookmarks(userId, item, parentCollectionId);
+      }
+    }
+  }
+}
+
+const createCollection = async (
+  userId: number,
+  collectionName: string,
+  parentId?: number
+) => {
+  const findCollection = await prisma.collection.findFirst({
+    where: {
+      parentId,
+      name: collectionName,
+      ownerId: userId,
+    },
+  });
+
+  if (findCollection) {
+    return findCollection.id;
+  }
+
+  const collectionId = await prisma.collection.create({
+    data: {
+      name: collectionName,
+      parent: parentId
+        ? {
+            connect: {
+              id: parentId,
+            },
+          }
+        : undefined,
+      owner: {
+        connect: {
+          id: userId,
+        },
+      },
+    },
+  });
+
+  createFolder({ filePath: `archives/${collectionId.id}` });
+
+  return collectionId.id;
+};
+
+const createLink = async (
+  userId: number,
+  url: string,
+  collectionId: number,
+  name?: string,
+  description?: string,
+  tags?: string[],
+  importDate?: Date
+) => {
+  await prisma.link.create({
+    data: {
+      name: name || "",
+      url,
+      description,
+      collectionId,
+      tags:
+        tags && tags[0]
+          ? {
+              connectOrCreate: tags.map((tag: string) => {
+                return (
+                  {
+                    where: {
+                      name_ownerId: {
+                        name: tag.trim(),
+                        ownerId: userId,
+                      },
+                    },
+                    create: {
+                      name: tag.trim(),
+                      owner: {
+                        connect: {
+                          id: userId,
+                        },
+                      },
+                    },
+                  } || undefined
+                );
+              }),
+            }
+          : undefined,
+      importDate: importDate || undefined,
+    },
+  });
+};
+
+function processNodes(nodes: Node[]) {
+  const findAndProcessDL = (node: Node) => {
+    if (node.type === "element" && node.tagName === "dl") {
+      processDLChildren(node);
+    } else if (
+      node.type === "element" &&
+      node.children &&
+      node.children.length
+    ) {
+      node.children.forEach((child) => findAndProcessDL(child));
+    }
+  };
+
+  const processDLChildren = (dlNode: Element) => {
+    dlNode.children.forEach((child, i) => {
+      if (child.type === "element" && child.tagName === "dt") {
+        const nextSibling = dlNode.children[i + 1];
+        if (
+          nextSibling &&
+          nextSibling.type === "element" &&
+          nextSibling.tagName === "dd"
+        ) {
+          const aElement = child.children.find(
+            (el) => el.type === "element" && el.tagName === "a"
+          );
+          if (aElement && aElement.type === "element") {
+            // Add the 'dd' element as a child of the 'a' element
+            aElement.children.push(nextSibling);
+            // Remove the 'dd' from the parent 'dl' to avoid duplicate processing
+            dlNode.children.splice(i + 1, 1);
+            // Adjust the loop counter due to the removal
+          }
+        }
+      }
+    });
+  };
+
+  nodes.forEach(findAndProcessDL);
+  return nodes;
+}

Securite/Linkwarden/lib/api/controllers/migration/importFromLinkwarden.ts

@@ -0,0 +1,96 @@
+import { prisma } from "@/lib/api/db";
+import { Backup } from "@/types/global";
+import createFolder from "@/lib/api/storage/createFolder";
+
+const MAX_LINKS_PER_USER = Number(process.env.MAX_LINKS_PER_USER) || 30000;
+
+export default async function importFromLinkwarden(
+  userId: number,
+  rawData: string
+) {
+  const data: Backup = JSON.parse(rawData);
+
+  let totalImports = 0;
+
+  data.collections.forEach((collection) => {
+    totalImports += collection.links.length;
+  });
+
+  const numberOfLinksTheUserHas = await prisma.link.count({
+    where: {
+      collection: {
+        ownerId: userId,
+      },
+    },
+  });
+
+  if (totalImports + numberOfLinksTheUserHas > MAX_LINKS_PER_USER)
+    return {
+      response: `Error: Each user can only have a maximum of ${MAX_LINKS_PER_USER} Links.`,
+      status: 400,
+    };
+
+  await prisma
+    .$transaction(
+      async () => {
+        // Import collections
+        for (const e of data.collections) {
+          e.name = e.name.trim();
+
+          const newCollection = await prisma.collection.create({
+            data: {
+              owner: {
+                connect: {
+                  id: userId,
+                },
+              },
+              name: e.name,
+              description: e.description,
+              color: e.color,
+            },
+          });
+
+          createFolder({ filePath: `archives/${newCollection.id}` });
+
+          // Import Links
+          for (const link of e.links) {
+            const newLink = await prisma.link.create({
+              data: {
+                url: link.url,
+                name: link.name,
+                description: link.description,
+                collection: {
+                  connect: {
+                    id: newCollection.id,
+                  },
+                },
+                // Import Tags
+                tags: {
+                  connectOrCreate: link.tags.map((tag) => ({
+                    where: {
+                      name_ownerId: {
+                        name: tag.name.trim(),
+                        ownerId: userId,
+                      },
+                    },
+                    create: {
+                      name: tag.name.trim(),
+                      owner: {
+                        connect: {
+                          id: userId,
+                        },
+                      },
+                    },
+                  })),
+                },
+              },
+            });
+          }
+        }
+      },
+      { timeout: 30000 }
+    )
+    .catch((err) => console.log(err));
+
+  return { response: "Success.", status: 200 };
+}

Securite/Linkwarden/lib/api/controllers/public/collections/getPublicCollection.ts

@@ -0,0 +1,32 @@
+import { prisma } from "@/lib/api/db";
+
+export default async function getPublicCollection(id: number) {
+  const collection = await prisma.collection.findFirst({
+    where: {
+      id,
+      isPublic: true,
+    },
+    include: {
+      members: {
+        include: {
+          user: {
+            select: {
+              username: true,
+              name: true,
+              image: true,
+            },
+          },
+        },
+      },
+      _count: {
+        select: { links: true },
+      },
+    },
+  });
+
+  if (collection) {
+    return { response: collection, status: 200 };
+  } else {
+    return { response: "Collection not found.", status: 400 };
+  }
+}

Securite/Linkwarden/lib/api/controllers/public/links/getPublicLinksUnderCollection.ts

@@ -0,0 +1,88 @@
+import { prisma } from "@/lib/api/db";
+import { LinkRequestQuery, Sort } from "@/types/global";
+
+export default async function getLink(
+  query: Omit<LinkRequestQuery, "tagId" | "pinnedOnly">
+) {
+  const POSTGRES_IS_ENABLED = process.env.DATABASE_URL.startsWith("postgresql");
+
+  let order: any;
+  if (query.sort === Sort.DateNewestFirst) order = { id: "desc" };
+  else if (query.sort === Sort.DateOldestFirst) order = { id: "asc" };
+  else if (query.sort === Sort.NameAZ) order = { name: "asc" };
+  else if (query.sort === Sort.NameZA) order = { name: "desc" };
+  else if (query.sort === Sort.DescriptionAZ) order = { description: "asc" };
+  else if (query.sort === Sort.DescriptionZA) order = { description: "desc" };
+
+  const searchConditions = [];
+
+  if (query.searchQueryString) {
+    if (query.searchByName) {
+      searchConditions.push({
+        name: {
+          contains: query.searchQueryString,
+          mode: POSTGRES_IS_ENABLED ? "insensitive" : undefined,
+        },
+      });
+    }
+
+    if (query.searchByUrl) {
+      searchConditions.push({
+        url: {
+          contains: query.searchQueryString,
+          mode: POSTGRES_IS_ENABLED ? "insensitive" : undefined,
+        },
+      });
+    }
+
+    if (query.searchByDescription) {
+      searchConditions.push({
+        description: {
+          contains: query.searchQueryString,
+          mode: POSTGRES_IS_ENABLED ? "insensitive" : undefined,
+        },
+      });
+    }
+
+    if (query.searchByTextContent) {
+      searchConditions.push({
+        textContent: {
+          contains: query.searchQueryString,
+          mode: POSTGRES_IS_ENABLED ? "insensitive" : undefined,
+        },
+      });
+    }
+
+    if (query.searchByTags) {
+      searchConditions.push({
+        tags: {
+          some: {
+            name: {
+              contains: query.searchQueryString,
+              mode: POSTGRES_IS_ENABLED ? "insensitive" : undefined,
+            },
+          },
+        },
+      });
+    }
+  }
+
+  const links = await prisma.link.findMany({
+    take: Number(process.env.PAGINATION_TAKE_COUNT) || 20,
+    skip: query.cursor ? 1 : undefined,
+    cursor: query.cursor ? { id: query.cursor } : undefined,
+    where: {
+      collection: {
+        id: query.collectionId,
+        isPublic: true,
+      },
+      [query.searchQueryString ? "OR" : "AND"]: [...searchConditions],
+    },
+    include: {
+      tags: true,
+    },
+    orderBy: order || { id: "desc" },
+  });
+
+  return { response: links, status: 200 };
+}

Securite/Linkwarden/lib/api/controllers/public/links/linkId/getLinkById.ts

@@ -0,0 +1,24 @@
+import { prisma } from "@/lib/api/db";
+
+export default async function getLinkById(linkId: number) {
+  if (!linkId)
+    return {
+      response: "Please choose a valid link.",
+      status: 401,
+    };
+
+  const link = await prisma.link.findFirst({
+    where: {
+      id: linkId,
+      collection: {
+        isPublic: true,
+      },
+    },
+    include: {
+      tags: true,
+      collection: true,
+    },
+  });
+
+  return { response: link, status: 200 };
+}

Securite/Linkwarden/lib/api/controllers/public/users/getPublicUser.ts

@@ -0,0 +1,82 @@
+import { prisma } from "@/lib/api/db";
+
+export default async function getPublicUser(
+  targetId: number | string,
+  isId: boolean,
+  requestingId?: number
+) {
+  const user = await prisma.user.findUnique({
+    where: isId
+      ? {
+          id: Number(targetId) as number,
+        }
+      : {
+          username: targetId as string,
+        },
+    include: {
+      whitelistedUsers: {
+        select: {
+          username: true,
+        },
+      },
+    },
+  });
+
+  if (!user)
+    return { response: "User not found or profile is private.", status: 404 };
+
+  const whitelistedUsernames = user.whitelistedUsers?.map(
+    (usernames) => usernames.username
+  );
+
+  const isInAPublicCollection = await prisma.collection.findFirst({
+    where: {
+      ["OR"]: [
+        { ownerId: user.id },
+        {
+          members: {
+            some: {
+              userId: user.id,
+            },
+          },
+        },
+      ],
+      isPublic: true,
+    },
+  });
+
+  if (user?.isPrivate && !isInAPublicCollection) {
+    if (requestingId) {
+      const requestingUser = await prisma.user.findUnique({
+        where: { id: requestingId },
+      });
+
+      if (
+        requestingUser?.id !== requestingId &&
+        (!requestingUser?.username ||
+          !whitelistedUsernames.includes(
+            requestingUser.username?.toLowerCase()
+          ))
+      ) {
+        return {
+          response: "User not found or profile is private.",
+          status: 404,
+        };
+      }
+    } else
+      return { response: "User not found or profile is private.", status: 404 };
+  }
+
+  const { password, ...lessSensitiveInfo } = user;
+
+  const data = {
+    id: lessSensitiveInfo.id,
+    name: lessSensitiveInfo.name,
+    username: lessSensitiveInfo.username,
+    image: lessSensitiveInfo.image,
+    archiveAsScreenshot: lessSensitiveInfo.archiveAsScreenshot,
+    archiveAsPDF: lessSensitiveInfo.archiveAsPDF,
+  };
+
+  return { response: data, status: 200 };
+}

Securite/Linkwarden/lib/api/controllers/tags/getTags.ts

@@ -0,0 +1,46 @@
+import { prisma } from "@/lib/api/db";
+
+export default async function getTags(userId: number) {
+  // Remove empty tags
+  await prisma.tag.deleteMany({
+    where: {
+      ownerId: userId,
+      links: {
+        none: {},
+      },
+    },
+  });
+
+  const tags = await prisma.tag.findMany({
+    where: {
+      OR: [
+        { ownerId: userId }, // Tags owned by the user
+        {
+          links: {
+            some: {
+              collection: {
+                members: {
+                  some: {
+                    userId, // Tags from collections where the user is a member
+                  },
+                },
+              },
+            },
+          },
+        },
+      ],
+    },
+    include: {
+      _count: {
+        select: { links: true },
+      },
+    },
+    // orderBy: {
+    //   links: {
+    //     _count: "desc",
+    //   },
+    // },
+  });
+
+  return { response: tags, status: 200 };
+}

Securite/Linkwarden/lib/api/controllers/tags/tagId/deleteTagById.ts

@@ -0,0 +1,26 @@
+import { prisma } from "@/lib/api/db";
+
+export default async function deleteTagById(userId: number, tagId: number) {
+  if (!tagId)
+    return { response: "Please choose a valid name for the tag.", status: 401 };
+
+  const targetTag = await prisma.tag.findUnique({
+    where: {
+      id: tagId,
+    },
+  });
+
+  if (targetTag?.ownerId !== userId)
+    return {
+      response: "Permission denied.",
+      status: 401,
+    };
+
+  const updatedTag = await prisma.tag.delete({
+    where: {
+      id: tagId,
+    },
+  });
+
+  return { response: updatedTag, status: 200 };
+}

Securite/Linkwarden/lib/api/controllers/tags/tagId/updeteTagById.ts

@@ -0,0 +1,47 @@
+import { prisma } from "@/lib/api/db";
+import { Tag } from "@prisma/client";
+
+export default async function updeteTagById(
+  userId: number,
+  tagId: number,
+  data: Tag
+) {
+  if (!tagId || !data.name)
+    return { response: "Please choose a valid name for the tag.", status: 401 };
+
+  const tagNameIsTaken = await prisma.tag.findFirst({
+    where: {
+      ownerId: userId,
+      name: data.name,
+    },
+  });
+
+  if (tagNameIsTaken)
+    return {
+      response: "Tag names should be unique.",
+      status: 400,
+    };
+
+  const targetTag = await prisma.tag.findUnique({
+    where: {
+      id: tagId,
+    },
+  });
+
+  if (targetTag?.ownerId !== userId)
+    return {
+      response: "Permission denied.",
+      status: 401,
+    };
+
+  const updatedTag = await prisma.tag.update({
+    where: {
+      id: tagId,
+    },
+    data: {
+      name: data.name,
+    },
+  });
+
+  return { response: updatedTag, status: 200 };
+}

Securite/Linkwarden/lib/api/controllers/tokens/getTokens.ts

@@ -0,0 +1,21 @@
+import { prisma } from "@/lib/api/db";
+
+export default async function getToken(userId: number) {
+  const getTokens = await prisma.accessToken.findMany({
+    where: {
+      userId,
+      revoked: false,
+    },
+    select: {
+      id: true,
+      name: true,
+      expires: true,
+      createdAt: true,
+    },
+  });
+
+  return {
+    response: getTokens,
+    status: 200,
+  };
+}

Securite/Linkwarden/lib/api/controllers/tokens/postToken.ts

@@ -0,0 +1,92 @@
+import { prisma } from "@/lib/api/db";
+import { TokenExpiry } from "@/types/global";
+import crypto from "crypto";
+import { decode, encode } from "next-auth/jwt";
+
+export default async function postToken(
+  body: {
+    name: string;
+    expires: TokenExpiry;
+  },
+  userId: number
+) {
+  console.log(body);
+
+  const checkHasEmptyFields = !body.name || body.expires === undefined;
+
+  if (checkHasEmptyFields)
+    return {
+      response: "Please fill out all the fields.",
+      status: 400,
+    };
+
+  const checkIfTokenExists = await prisma.accessToken.findFirst({
+    where: {
+      name: body.name,
+      revoked: false,
+      userId,
+    },
+  });
+
+  if (checkIfTokenExists) {
+    return {
+      response: "Token with that name already exists.",
+      status: 400,
+    };
+  }
+
+  const now = Date.now();
+  let expiryDate = new Date();
+  const oneDayInSeconds = 86400;
+  let expiryDateSecond = 7 * oneDayInSeconds;
+
+  if (body.expires === TokenExpiry.oneMonth) {
+    expiryDate.setDate(expiryDate.getDate() + 30);
+    expiryDateSecond = 30 * oneDayInSeconds;
+  } else if (body.expires === TokenExpiry.twoMonths) {
+    expiryDate.setDate(expiryDate.getDate() + 60);
+    expiryDateSecond = 60 * oneDayInSeconds;
+  } else if (body.expires === TokenExpiry.threeMonths) {
+    expiryDate.setDate(expiryDate.getDate() + 90);
+    expiryDateSecond = 90 * oneDayInSeconds;
+  } else if (body.expires === TokenExpiry.never) {
+    expiryDate.setDate(expiryDate.getDate() + 73000); // 200 years (not really never)
+    expiryDateSecond = 73050 * oneDayInSeconds;
+  } else {
+    expiryDate.setDate(expiryDate.getDate() + 7);
+    expiryDateSecond = 7 * oneDayInSeconds;
+  }
+
+  const token = await encode({
+    token: {
+      id: userId,
+      iat: now / 1000,
+      exp: (expiryDate as any) / 1000,
+      jti: crypto.randomUUID(),
+    },
+    maxAge: expiryDateSecond || 604800,
+    secret: process.env.NEXTAUTH_SECRET,
+  });
+
+  const tokenBody = await decode({
+    token,
+    secret: process.env.NEXTAUTH_SECRET,
+  });
+
+  const createToken = await prisma.accessToken.create({
+    data: {
+      name: body.name,
+      userId,
+      token: tokenBody?.jti as string,
+      expires: expiryDate,
+    },
+  });
+
+  return {
+    response: {
+      secretKey: token,
+      token: createToken,
+    },
+    status: 200,
+  };
+}

Securite/Linkwarden/lib/api/controllers/tokens/tokenId/deleteTokenById.ts

@@ -0,0 +1,24 @@
+import { prisma } from "@/lib/api/db";
+
+export default async function deleteToken(userId: number, tokenId: number) {
+  if (!tokenId)
+    return { response: "Please choose a valid token.", status: 401 };
+
+  const tokenExists = await prisma.accessToken.findFirst({
+    where: {
+      id: tokenId,
+      userId,
+    },
+  });
+
+  const revokedToken = await prisma.accessToken.update({
+    where: {
+      id: tokenExists?.id,
+    },
+    data: {
+      revoked: true,
+    },
+  });
+
+  return { response: revokedToken, status: 200 };
+}

Securite/Linkwarden/lib/api/controllers/users/postUser.ts

@@ -0,0 +1,91 @@
+import { prisma } from "@/lib/api/db";
+import type { NextApiRequest, NextApiResponse } from "next";
+import bcrypt from "bcrypt";
+
+const emailEnabled =
+  process.env.EMAIL_FROM && process.env.EMAIL_SERVER ? true : false;
+
+interface Data {
+  response: string | object;
+}
+
+interface User {
+  name: string;
+  username?: string;
+  email?: string;
+  password: string;
+}
+
+export default async function postUser(
+  req: NextApiRequest,
+  res: NextApiResponse<Data>
+) {
+  if (process.env.NEXT_PUBLIC_DISABLE_REGISTRATION === "true") {
+    return res.status(400).json({ response: "Registration is disabled." });
+  }
+
+  const body: User = req.body;
+
+  const checkHasEmptyFields = emailEnabled
+    ? !body.password || !body.name || !body.email
+    : !body.username || !body.password || !body.name;
+
+  if (!body.password || body.password.length < 8)
+    return res
+      .status(400)
+      .json({ response: "Password must be at least 8 characters." });
+
+  if (checkHasEmptyFields)
+    return res
+      .status(400)
+      .json({ response: "Please fill out all the fields." });
+
+  // Check email (if enabled)
+  const checkEmail =
+    /^(([^<>()[\]\.,;:\s@\"]+(\.[^<>()[\]\.,;:\s@\"]+)*)|(\".+\"))@(([^<>()[\]\.,;:\s@\"]+\.)+[^<>()[\]\.,;:\s@\"]{2,})$/i;
+  if (emailEnabled && !checkEmail.test(body.email?.toLowerCase() || ""))
+    return res.status(400).json({
+      response: "Please enter a valid email.",
+    });
+
+  // Check username (if email was disabled)
+  const checkUsername = RegExp("^[a-z0-9_-]{3,31}$");
+  if (!emailEnabled && !checkUsername.test(body.username?.toLowerCase() || ""))
+    return res.status(400).json({
+      response:
+        "Username has to be between 3-30 characters, no spaces and special characters are allowed.",
+    });
+
+  const checkIfUserExists = await prisma.user.findFirst({
+    where: emailEnabled
+      ? {
+          email: body.email?.toLowerCase().trim(),
+        }
+      : {
+          username: (body.username as string).toLowerCase().trim(),
+        },
+  });
+
+  if (!checkIfUserExists) {
+    const saltRounds = 10;
+
+    const hashedPassword = bcrypt.hashSync(body.password, saltRounds);
+
+    await prisma.user.create({
+      data: {
+        name: body.name,
+        username: emailEnabled
+          ? undefined
+          : (body.username as string).toLowerCase().trim(),
+        email: emailEnabled ? body.email?.toLowerCase().trim() : undefined,
+        password: hashedPassword,
+      },
+    });
+
+    return res.status(201).json({ response: "User successfully created." });
+  } else if (checkIfUserExists) {
+    return res.status(400).json({
+      response: `${emailEnabled ? "Email" : "Username"} already exists.`,
+    });
+  }
+}

Securite/Linkwarden/lib/api/controllers/users/userId/deleteUserById.ts

@@ -0,0 +1,141 @@
+import { prisma } from "@/lib/api/db";
+import bcrypt from "bcrypt";
+import removeFolder from "@/lib/api/storage/removeFolder";
+import Stripe from "stripe";
+import { DeleteUserBody } from "@/types/global";
+import removeFile from "@/lib/api/storage/removeFile";
+
+const keycloakEnabled = process.env.KEYCLOAK_CLIENT_SECRET;
+const authentikEnabled = process.env.AUTHENTIK_CLIENT_SECRET;
+
+export default async function deleteUserById(
+  userId: number,
+  body: DeleteUserBody
+) {
+  // First, we retrieve the user from the database
+  const user = await prisma.user.findUnique({
+    where: { id: userId },
+  });
+
+  if (!user) {
+    return {
+      response: "Invalid credentials.",
+      status: 404,
+    };
+  }
+
+  // Then, we check if the provided password matches the one stored in the database (disabled in Keycloak integration)
+  if (!keycloakEnabled && !authentikEnabled) {
+    const isPasswordValid = bcrypt.compareSync(
+      body.password,
+      user.password as string
+    );
+
+    if (!isPasswordValid) {
+      return {
+        response: "Invalid credentials.",
+        status: 401, // Unauthorized
+      };
+    }
+  }
+
+  // Delete the user and all related data within a transaction
+  await prisma
+    .$transaction(
+      async (prisma) => {
+        // Delete whitelisted users
+        await prisma.whitelistedUser.deleteMany({
+          where: { userId },
+        });
+
+        // Delete links
+        await prisma.link.deleteMany({
+          where: { collection: { ownerId: userId } },
+        });
+
+        // Delete tags
+        await prisma.tag.deleteMany({
+          where: { ownerId: userId },
+        });
+
+        // Find collections that the user owns
+        const collections = await prisma.collection.findMany({
+          where: { ownerId: userId },
+        });
+
+        for (const collection of collections) {
+          // Delete related users and collections relations
+          await prisma.usersAndCollections.deleteMany({
+            where: { collectionId: collection.id },
+          });
+
+          // Delete archive folders
+          removeFolder({ filePath: `archives/${collection.id}` });
+        }
+
+        // Delete collections after cleaning up related data
+        await prisma.collection.deleteMany({
+          where: { ownerId: userId },
+        });
+
+        // Delete subscription
+        if (process.env.STRIPE_SECRET_KEY)
+          await prisma.subscription.delete({
+            where: { userId },
+          });
+
+        await prisma.usersAndCollections.deleteMany({
+          where: {
+            OR: [{ userId: userId }, { collection: { ownerId: userId } }],
+          },
+        });
+
+        // Delete user's avatar
+        await removeFile({ filePath: `uploads/avatar/${userId}.jpg` });
+
+        // Finally, delete the user
+        await prisma.user.delete({
+          where: { id: userId },
+        });
+      },
+      { timeout: 20000 }
+    )
+    .catch((err) => console.log(err));
+
+  if (process.env.STRIPE_SECRET_KEY) {
+    const stripe = new Stripe(process.env.STRIPE_SECRET_KEY, {
+      apiVersion: "2022-11-15",
+    });
+
+    try {
+      const listByEmail = await stripe.customers.list({
+        email: user.email?.toLowerCase(),
+        expand: ["data.subscriptions"],
+      });
+
+      if (listByEmail.data[0].subscriptions?.data[0].id) {
+        const deleted = await stripe.subscriptions.cancel(
+          listByEmail.data[0].subscriptions?.data[0].id,
+          {
+            cancellation_details: {
+              comment: body.cancellation_details?.comment,
+              feedback: body.cancellation_details?.feedback,
+            },
+          }
+        );
+
+        return {
+          response: deleted,
+          status: 200,
+        };
+      }
+    } catch (err) {
+      console.log(err);
+    }
+  }
+
+  return {
+    response: "User account and all related data deleted successfully.",
+    status: 200,
+  };
+}

Securite/Linkwarden/lib/api/controllers/users/userId/getUserById.ts

@@ -0,0 +1,36 @@
+import { prisma } from "@/lib/api/db";
+
+export default async function getUserById(userId: number) {
+  const user = await prisma.user.findUnique({
+    where: {
+      id: userId,
+    },
+    include: {
+      whitelistedUsers: {
+        select: {
+          username: true,
+        },
+      },
+      subscriptions: true,
+    },
+  });
+
+  if (!user)
+    return { response: "User not found or profile is private.", status: 404 };
+
+  const whitelistedUsernames = user.whitelistedUsers?.map(
+    (usernames) => usernames.username
+  );
+
+  const { password, subscriptions, ...lessSensitiveInfo } = user;
+
+  const data = {
+    ...lessSensitiveInfo,
+    whitelistedUsers: whitelistedUsernames,
+    subscription: {
+      active: subscriptions?.active,
+    },
+  };
+
+  return { response: data, status: 200 };
+}

Securite/Linkwarden/lib/api/controllers/users/userId/updateUserById.ts

@@ -0,0 +1,264 @@
+import { prisma } from "@/lib/api/db";
+import { AccountSettings } from "@/types/global";
+import bcrypt from "bcrypt";
+import removeFile from "@/lib/api/storage/removeFile";
+import createFile from "@/lib/api/storage/createFile";
+import updateCustomerEmail from "@/lib/api/updateCustomerEmail";
+import createFolder from "@/lib/api/storage/createFolder";
+
+const emailEnabled =
+  process.env.EMAIL_FROM && process.env.EMAIL_SERVER ? true : false;
+
+export default async function updateUserById(
+  userId: number,
+  data: AccountSettings
+) {
+  const ssoUser = await prisma.account.findFirst({
+    where: {
+      userId: userId,
+    },
+  });
+  const user = await prisma.user.findUnique({
+    where: {
+      id: userId,
+    },
+  });
+
+  if (ssoUser) {
+    // deny changes to SSO-defined properties
+    if (data.email !== user?.email) {
+      return {
+        response: "SSO users cannot change their email.",
+        status: 400,
+      };
+    }
+    if (data.newPassword) {
+      return {
+        response: "SSO Users cannot change their password.",
+        status: 400,
+      };
+    }
+    if (data.name !== user?.name) {
+      return {
+        response: "SSO Users cannot change their name.",
+        status: 400,
+      };
+    }
+    if (data.username !== user?.username) {
+      return {
+        response: "SSO Users cannot change their username.",
+        status: 400,
+      };
+    }
+    if (data.image?.startsWith("data:image/jpeg;base64")) {
+      return {
+        response: "SSO Users cannot change their avatar.",
+        status: 400,
+      };
+    }
+  } else {
+    // verify only for non-SSO users
+    // SSO users cannot change their email, password, name, username, or avatar
+    if (emailEnabled && !data.email)
+      return {
+        response: "Email invalid.",
+        status: 400,
+      };
+    else if (!data.username)
+      return {
+        response: "Username invalid.",
+        status: 400,
+      };
+    if (data.newPassword && data.newPassword?.length < 8)
+      return {
+        response: "Password must be at least 8 characters.",
+        status: 400,
+      };
+    // Check email (if enabled)
+    const checkEmail =
+      /^(([^<>()[\]\.,;:\s@\"]+(\.[^<>()[\]\.,;:\s@\"]+)*)|(\".+\"))@(([^<>()[\]\.,;:\s@\"]+\.)+[^<>()[\]\.,;:\s@\"]{2,})$/i;
+    if (emailEnabled && !checkEmail.test(data.email?.toLowerCase() || ""))
+      return {
+        response: "Please enter a valid email.",
+        status: 400,
+      };
+
+    const checkUsername = RegExp("^[a-z0-9_-]{3,31}$");
+
+    if (!checkUsername.test(data.username.toLowerCase()))
+      return {
+        response:
+          "Username has to be between 3-30 characters, no spaces and special characters are allowed.",
+        status: 400,
+      };
+
+    const userIsTaken = await prisma.user.findFirst({
+      where: {
+        id: { not: userId },
+        OR: emailEnabled
+          ? [
+              {
+                username: data.username.toLowerCase(),
+              },
+              {
+                email: data.email?.toLowerCase(),
+              },
+            ]
+          : [
+              {
+                username: data.username.toLowerCase(),
+              },
+            ],
+      },
+    });
+
+    if (userIsTaken) {
+      if (data.email?.toLowerCase().trim() === userIsTaken.email?.trim())
+        return {
+          response: "Email is taken.",
+          status: 400,
+        };
+      else if (
+        data.username?.toLowerCase().trim() === userIsTaken.username?.trim()
+      )
+        return {
+          response: "Username is taken.",
+          status: 400,
+        };
+
+      return {
+        response: "Username/Email is taken.",
+        status: 400,
+      };
+    }
+
+    // Avatar Settings
+
+    if (data.image?.startsWith("data:image/jpeg;base64")) {
+      if (data.image.length < 1572864) {
+        try {
+          const base64Data = data.image.replace(
+            /^data:image\/jpeg;base64,/,
+            ""
+          );
+
+          createFolder({ filePath: `uploads/avatar` });
+
+          await createFile({
+            filePath: `uploads/avatar/${userId}.jpg`,
+            data: base64Data,
+            isBase64: true,
+          });
+        } catch (err) {
+          console.log("Error saving image:", err);
+        }
+      } else {
+        console.log("A file larger than 1.5MB was uploaded.");
+        return {
+          response: "A file larger than 1.5MB was uploaded.",
+          status: 400,
+        };
+      }
+    } else if (data.image == "") {
+      removeFile({ filePath: `uploads/avatar/${userId}.jpg` });
+    }
+  }
+
+  const previousEmail = (
+    await prisma.user.findUnique({ where: { id: userId } })
+  )?.email;
+
+  // Other settings
+
+  const saltRounds = 10;
+  const newHashedPassword = bcrypt.hashSync(data.newPassword || "", saltRounds);
+
+  const updatedUser = await prisma.user.update({
+    where: {
+      id: userId,
+    },
+    data: {
+      name: data.name,
+      username: data.username?.toLowerCase().trim(),
+      email: data.email?.toLowerCase().trim(),
+      isPrivate: data.isPrivate,
+      image: data.image ? `uploads/avatar/${userId}.jpg` : "",
+      collectionOrder: data.collectionOrder.filter(
+        (value, index, self) => self.indexOf(value) === index
+      ),
+      archiveAsScreenshot: data.archiveAsScreenshot,
+      archiveAsPDF: data.archiveAsPDF,
+      archiveAsWaybackMachine: data.archiveAsWaybackMachine,
+      linksRouteTo: data.linksRouteTo,
+      preventDuplicateLinks: data.preventDuplicateLinks,
+      password:
+        data.newPassword && data.newPassword !== ""
+          ? newHashedPassword
+          : undefined,
+    },
+    include: {
+      whitelistedUsers: true,
+      subscriptions: true,
+    },
+  });
+
+  const { whitelistedUsers, password, subscriptions, ...userInfo } =
+    updatedUser;
+
+  // If user.whitelistedUsers is not provided, we will assume the whitelistedUsers should be removed
+  const newWhitelistedUsernames: string[] = data.whitelistedUsers || [];
+
+  // Get the current whitelisted usernames
+  const currentWhitelistedUsernames: string[] = whitelistedUsers.map(
+    (data) => data.username
+  );
+
+  // Find the usernames to be deleted (present in current but not in new)
+  const usernamesToDelete: string[] = currentWhitelistedUsernames.filter(
+    (username) => !newWhitelistedUsernames.includes(username)
+  );
+
+  // Find the usernames to be created (present in new but not in current)
+  const usernamesToCreate: string[] = newWhitelistedUsernames.filter(
+    (username) =>
+      !currentWhitelistedUsernames.includes(username) && username.trim() !== ""
+  );
+
+  // Delete whitelistedUsers that are not present in the new list
+  await prisma.whitelistedUser.deleteMany({
+    where: {
+      userId: userId,
+      username: {
+        in: usernamesToDelete,
+      },
+    },
+  });
+
+  // Create new whitelistedUsers that are not in the current list, no create many ;(
+  for (const username of usernamesToCreate) {
+    await prisma.whitelistedUser.create({
+      data: {
+        username,
+        userId: userId,
+      },
+    });
+  }
+
+  const STRIPE_SECRET_KEY = process.env.STRIPE_SECRET_KEY;
+
+  if (STRIPE_SECRET_KEY && emailEnabled && previousEmail !== data.email)
+    await updateCustomerEmail(
+      STRIPE_SECRET_KEY,
+      previousEmail as string,
+      data.email as string
+    );
+
+  const response: Omit<AccountSettings, "password"> = {
+    ...userInfo,
+    whitelistedUsers: newWhitelistedUsernames,
+    image: userInfo.image ? `${userInfo.image}?${Date.now()}` : "",
+    subscription: { active: subscriptions?.active },
+  };
+
+  return { response, status: 200 };
+}

Securite/Linkwarden/lib/api/db.ts

@@ -0,0 +1,19 @@
+import { PrismaClient } from "@prisma/client";
+
+const globalForPrisma = global as unknown as { prisma: PrismaClient };
+
+export const prisma =
+  globalForPrisma.prisma ||
+  new PrismaClient({
+    log: ["query"],
+  });
+
+if (process.env.NODE_ENV !== "production") globalForPrisma.prisma = prisma;
+
+// For benchmarking | uncomment when needed
+// if (process.env.NODE_ENV !== "production")
+//   prisma.$on("query" as any, (e: any) => {
+//     console.log("Query: " + e.query);
+//     console.log("Params: " + e.params);
+//     console.log("\x1b[31m", `Duration: ${e.duration}ms`, "\x1b[0m");
+//   });

Securite/Linkwarden/lib/api/getPermission.ts

@@ -0,0 +1,41 @@
+import { prisma } from "@/lib/api/db";
+
+type Props = {
+  userId: number;
+  collectionId?: number;
+  collectionName?: string;
+  linkId?: number;
+};
+
+export default async function getPermission({
+  userId,
+  collectionId,
+  collectionName,
+  linkId,
+}: Props) {
+  if (linkId) {
+    const check = await prisma.collection.findFirst({
+      where: {
+        links: {
+          some: {
+            id: linkId,
+          },
+        },
+      },
+      include: { members: true },
+    });
+
+    return check;
+  } else if (collectionId || collectionName) {
+    const check = await prisma.collection.findFirst({
+      where: {
+        id: collectionId || undefined,
+        name: collectionName || undefined,
+        OR: [{ ownerId: userId }, { members: { some: { userId } } }],
+      },
+      include: { members: true },
+    });
+
+    return check;
+  }
+}

Securite/Linkwarden/lib/api/paymentCheckout.ts

@@ -0,0 +1,44 @@
+import Stripe from "stripe";
+
+export default async function paymentCheckout(
+  stripeSecretKey: string,
+  email: string,
+  priceId: string
+) {
+  const stripe = new Stripe(stripeSecretKey, {
+    apiVersion: "2022-11-15",
+  });
+
+  const listByEmail = await stripe.customers.list({
+    email: email.toLowerCase(),
+    expand: ["data.subscriptions"],
+  });
+
+  const isExistingCustomer = listByEmail?.data[0]?.id || undefined;
+
+  const NEXT_PUBLIC_TRIAL_PERIOD_DAYS =
+    process.env.NEXT_PUBLIC_TRIAL_PERIOD_DAYS;
+  const session = await stripe.checkout.sessions.create({
+    customer: isExistingCustomer ? isExistingCustomer : undefined,
+    line_items: [
+      {
+        price: priceId,
+        quantity: 1,
+      },
+    ],
+    mode: "subscription",
+    customer_email: isExistingCustomer ? undefined : email.toLowerCase(),
+    success_url: `${process.env.BASE_URL}?session_id={CHECKOUT_SESSION_ID}`,
+    cancel_url: `${process.env.BASE_URL}/login`,
+    automatic_tax: {
+      enabled: true,
+    },
+    subscription_data: {
+      trial_period_days: NEXT_PUBLIC_TRIAL_PERIOD_DAYS
+        ? Number(NEXT_PUBLIC_TRIAL_PERIOD_DAYS)
+        : 14,
+    },
+  });
+
+  return { response: session.url, status: 200 };
+}

Securite/Linkwarden/lib/api/sendToWayback.ts

@@ -0,0 +1,23 @@
+import axios from "axios";
+
+export default async function sendToWayback(url: string) {
+  const headers = {
+    Accept: "text/html,application/xhtml+xml,application/xml",
+    "Accept-Encoding": "gzip, deflate",
+    Dnt: "1",
+    "Upgrade-Insecure-Requests": "1",
+    "User-Agent":
+      "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36",
+  };
+
+  await axios
+    .get(`https://web.archive.org/save/${url}`, {
+      headers: headers,
+    })
+    .then((response) => {
+      console.log(response.data);
+    })
+    .catch((error) => {
+      console.error(error);
+    });
+}

Securite/Linkwarden/lib/api/sendVerificationRequest.ts

@@ -0,0 +1,76 @@
+import { Theme } from "next-auth";
+import { SendVerificationRequestParams } from "next-auth/providers";
+import { createTransport } from "nodemailer";
+
+export default async function sendVerificationRequest(
+  params: SendVerificationRequestParams
+) {
+  const { identifier, url, provider, theme } = params;
+  const { host } = new URL(url);
+  const transport = createTransport(provider.server);
+  const result = await transport.sendMail({
+    to: identifier,
+    from: provider.from,
+    subject: `Sign in to ${host}`,
+    text: text({ url, host }),
+    html: html({ url, host, theme }),
+  });
+  const failed = result.rejected.concat(result.pending).filter(Boolean);
+  if (failed.length) {
+    throw new Error(`Email (${failed.join(", ")}) could not be sent`);
+  }
+}
+
+function html(params: { url: string; host: string; theme: Theme }) {
+  const { url, host, theme } = params;
+
+  const escapedHost = host.replace(/\./g, "​.");
+
+  const brandColor = theme.brandColor || "#0029cf";
+  const color = {
+    background: "#f9f9f9",
+    text: "#444",
+    mainBackground: "#fff",
+    buttonBackground: brandColor,
+    buttonBorder: brandColor,
+    buttonText: theme.buttonText || "#fff",
+  };
+
+  return `
+<body style="background: ${color.background};">
+  <table width="100%" border="0" cellspacing="20" cellpadding="0"
+    style="background: ${color.mainBackground}; max-width: 600px; margin: auto; border-radius: 10px;">
+    <tr>
+      <td align="center"
+        style="padding: 10px 0px; font-size: 22px; font-family: Helvetica, Arial, sans-serif; color: ${color.text};">
+        Sign in to <strong>${escapedHost}</strong>
+      </td>
+    </tr>
+    <tr>
+      <td align="center" style="padding: 20px 0;">
+        <table border="0" cellspacing="0" cellpadding="0">
+          <tr>
+            <td align="center" style="border-radius: 5px;" bgcolor="${color.buttonBackground}">
+              <a href="${url}" target="_blank" style="font-size: 18px; font-family: Helvetica, Arial, sans-serif; color: ${color.buttonText}; text-decoration: none; border-radius: 5px; padding: 10px 20px; border: 1px solid ${color.buttonBorder}; display: inline-block; font-weight: bold;">
+                Sign in
+              </a>
+            </td>
+          </tr>
+        </table>
+      </td>
+    </tr>
+    <tr>
+      <td align="center"
+        style="padding: 0px 0px 10px 0px; font-size: 16px; line-height: 22px; font-family: Helvetica, Arial, sans-serif; color: ${color.text};">
+        If you did not request this email you can safely ignore it.
+      </td>
+    </tr>
+  </table>
+</body>
+`;
+}
+
+/** Email Text body (fallback for email clients that don't render HTML, e.g. feature phones) */
+function text({ url, host }: { url: string; host: string }) {
+  return `Sign in to ${host}\n${url}\n\n`;
+}

Securite/Linkwarden/lib/api/storage/createFile.ts

@@ -0,0 +1,40 @@
+import { PutObjectCommand, PutObjectCommandInput } from "@aws-sdk/client-s3";
+import fs from "fs";
+import path from "path";
+import s3Client from "./s3Client";
+
+export default async function createFile({
+  filePath,
+  data,
+  isBase64,
+}: {
+  filePath: string;
+  data: Buffer | string;
+  isBase64?: boolean;
+}) {
+  if (s3Client) {
+    const bucketParams: PutObjectCommandInput = {
+      Bucket: process.env.SPACES_BUCKET_NAME,
+      Key: filePath,
+      Body: isBase64 ? Buffer.from(data as string, "base64") : data,
+    };
+
+    try {
+      await s3Client.send(new PutObjectCommand(bucketParams));
+
+      return true;
+    } catch (err) {
+      console.log("Error", err);
+      return false;
+    }
+  } else {
+    const storagePath = process.env.STORAGE_FOLDER || "data";
+    const creationPath = path.join(process.cwd(), storagePath + "/" + filePath);
+
+    fs.writeFile(creationPath, data, isBase64 ? "base64" : {}, function (err) {
+      if (err) console.log(err);
+    });
+
+    return true;
+  }
+}

Securite/Linkwarden/lib/api/storage/createFolder.ts

@@ -0,0 +1,14 @@
+import fs from "fs";
+import path from "path";
+import s3Client from "./s3Client";
+
+export default function createFolder({ filePath }: { filePath: string }) {
+  if (s3Client) {
+    // Do nothing, S3 creates directories recursively
+  } else {
+    const storagePath = process.env.STORAGE_FOLDER || "data";
+    const creationPath = path.join(process.cwd(), storagePath + "/" + filePath);
+
+    fs.mkdirSync(creationPath, { recursive: true });
+  }
+}

Securite/Linkwarden/lib/api/storage/moveFile.ts

@@ -0,0 +1,37 @@
+import fs from "fs";
+import path from "path";
+import s3Client from "./s3Client";
+import removeFile from "./removeFile";
+
+export default async function moveFile(from: string, to: string) {
+  if (s3Client) {
+    const Bucket = process.env.SPACES_BUCKET_NAME;
+
+    const copyParams = {
+      Bucket: Bucket,
+      CopySource: `/${Bucket}/${from}`,
+      Key: to,
+    };
+
+    try {
+      s3Client.copyObject(copyParams, async (err: any) => {
+        if (err) {
+          console.error("Error copying the object:", err);
+        } else {
+          await removeFile({ filePath: from });
+        }
+      });
+    } catch (err) {
+      console.log("Error:", err);
+    }
+  } else {
+    const storagePath = process.env.STORAGE_FOLDER || "data";
+
+    const directory = (file: string) =>
+      path.join(process.cwd(), storagePath + "/" + file);
+
+    fs.rename(directory(from), directory(to), (err) => {
+      if (err) console.log("Error copying file:", err);
+    });
+  }
+}

Securite/Linkwarden/lib/api/storage/readFile.ts

@@ -0,0 +1,135 @@
+import {
+  GetObjectCommand,
+  GetObjectCommandInput,
+  S3,
+} from "@aws-sdk/client-s3";
+import fs from "fs";
+import path from "path";
+import s3Client from "./s3Client";
+import util from "util";
+
+type ReturnContentTypes =
+  | "text/plain"
+  | "image/jpeg"
+  | "image/png"
+  | "application/pdf"
+  | "application/json";
+
+export default async function readFile(filePath: string) {
+  let contentType: ReturnContentTypes;
+
+  if (s3Client) {
+    const bucketParams: GetObjectCommandInput = {
+      Bucket: process.env.SPACES_BUCKET_NAME,
+      Key: filePath,
+    };
+
+    try {
+      let returnObject:
+        | {
+            file: Buffer | string;
+            contentType: ReturnContentTypes;
+            status: number;
+          }
+        | undefined;
+
+      const headObjectAsync = util.promisify(
+        s3Client.headObject.bind(s3Client)
+      );
+
+      try {
+        await headObjectAsync(bucketParams);
+      } catch (err) {
+        contentType = "text/plain";
+
+        returnObject = {
+          file: "File not found.",
+          contentType,
+          status: 400,
+        };
+      }
+
+      if (!returnObject) {
+        const response = await (s3Client as S3).send(
+          new GetObjectCommand(bucketParams)
+        );
+        const data = await streamToBuffer(response.Body);
+
+        if (filePath.endsWith(".pdf")) {
+          contentType = "application/pdf";
+        } else if (filePath.endsWith(".png")) {
+          contentType = "image/png";
+        } else if (filePath.endsWith("_readability.json")) {
+          contentType = "application/json";
+        } else {
+          // if (filePath.endsWith(".jpg"))
+          contentType = "image/jpeg";
+        }
+        returnObject = { file: data as Buffer, contentType, status: 200 };
+      }
+
+      return returnObject;
+    } catch (err) {
+      console.log("Error:", err);
+
+      contentType = "text/plain";
+      return {
+        file: "An internal occurred, please contact the support team.",
+        contentType,
+      };
+    }
+  } else {
+    const storagePath = process.env.STORAGE_FOLDER || "data";
+    const creationPath = path.join(process.cwd(), storagePath + "/" + filePath);
+
+    if (filePath.endsWith(".pdf")) {
+      contentType = "application/pdf";
+    } else if (filePath.endsWith(".png")) {
+      contentType = "image/png";
+    } else if (filePath.endsWith("_readability.json")) {
+      contentType = "application/json";
+    } else {
+      // if (filePath.endsWith(".jpg"))
+      contentType = "image/jpeg";
+    }
+
+    if (!fs.existsSync(creationPath))
+      return {
+        file: "File not found.",
+        contentType: "text/plain",
+        status: 404,
+      };
+    else {
+      const file = fs.readFileSync(creationPath);
+      return { file, contentType, status: 200 };
+    }
+  }
+}
+
+// Turn the file's body into buffer
+const streamToBuffer = (stream: any) => {
+  const chunks: any = [];
+  return new Promise((resolve, reject) => {
+    stream.on("data", (chunk: any) => chunks.push(Buffer.from(chunk)));
+    stream.on("error", (err: any) => reject(err));
+    stream.on("end", () => resolve(Buffer.concat(chunks)));
+  });
+};
+
+const fileNotFoundTemplate = `<!DOCTYPE html>
+                              <html lang="en">
+                              <head>
+                                <meta charset="UTF-8">
+                                <meta name="viewport" content="width=device-width, initial-scale=1.0">
+                                <title>File not found</title>
+                              </head>
+                              <body style="margin-left: auto; margin-right: auto; max-width: 500px; padding: 1rem; font-family: sans-serif; background-color: rgb(251, 251, 251);">
+                                <h1>File not found</h1>
+                                <h2>It is possible that the file you're looking for either doesn't exist or hasn't been created yet.</h2>
+                                <h3>Some possible reasons are:</h3>
+                                <ul>
+                                  <li>You are trying to access a file too early, before it has been fully archived. If that's the case, refreshing the page might resolve the issue.</li>
+                                  <li>The file doesn't exist either because it encountered an error while being archived, or it simply doesn't exist.</li>
+                                </ul>
+                              </body>
+                              </html>`;

Securite/Linkwarden/lib/api/storage/removeFile.ts

@@ -0,0 +1,26 @@
+import fs from "fs";
+import path from "path";
+import s3Client from "./s3Client";
+import { PutObjectCommandInput, DeleteObjectCommand } from "@aws-sdk/client-s3";
+
+export default async function removeFile({ filePath }: { filePath: string }) {
+  if (s3Client) {
+    const bucketParams: PutObjectCommandInput = {
+      Bucket: process.env.SPACES_BUCKET_NAME,
+      Key: filePath,
+    };
+
+    try {
+      await s3Client.send(new DeleteObjectCommand(bucketParams));
+    } catch (err) {
+      console.log("Error", err);
+    }
+  } else {
+    const storagePath = process.env.STORAGE_FOLDER || "data";
+    const creationPath = path.join(process.cwd(), storagePath + "/" + filePath);
+
+    fs.unlink(creationPath, (err) => {
+      if (err) console.log(err);
+    });
+  }
+}

Securite/Linkwarden/lib/api/storage/removeFolder.ts

@@ -0,0 +1,62 @@
+import fs from "fs";
+import path from "path";
+import s3Client from "./s3Client";
+import {
+  DeleteObjectsCommand,
+  DeleteObjectsCommandInput,
+  ListObjectsCommand,
+} from "@aws-sdk/client-s3";
+
+async function emptyS3Directory(bucket: string, dir: string) {
+  if (s3Client) {
+    const listParams = {
+      Bucket: bucket,
+      Prefix: dir,
+    };
+
+    const deleteParams: DeleteObjectsCommandInput = {
+      Bucket: bucket,
+      Delete: { Objects: [] },
+    };
+
+    const listedObjects = await s3Client.send(
+      new ListObjectsCommand(listParams)
+    );
+
+    if (listedObjects.Contents?.length === 0) return;
+
+    listedObjects.Contents?.forEach(({ Key }) => {
+      deleteParams.Delete?.Objects?.push({ Key });
+    });
+
+    console.log(listedObjects);
+
+    await s3Client.send(new DeleteObjectsCommand(deleteParams));
+
+    if (listedObjects.IsTruncated) await emptyS3Directory(bucket, dir);
+  }
+}
+
+export default async function removeFolder({ filePath }: { filePath: string }) {
+  if (s3Client) {
+    try {
+      await emptyS3Directory(
+        process.env.SPACES_BUCKET_NAME as string,
+        filePath
+      );
+    } catch (err) {
+      console.log("Error", err);
+    }
+  } else {
+    const storagePath = process.env.STORAGE_FOLDER || "data";
+    const creationPath = path.join(process.cwd(), storagePath + "/" + filePath);
+
+    try {
+      fs.rmdirSync(creationPath, { recursive: true });
+    } catch (error) {
+      console.log(
+        "Collection's archive directory wasn't deleted most likely because it didn't exist..."
+      );
+    }
+  }
+}

Securite/Linkwarden/lib/api/storage/s3Client.ts

@@ -0,0 +1,19 @@
+import { S3 } from "@aws-sdk/client-s3";
+
+const s3Client: S3 | undefined =
+  process.env.SPACES_ENDPOINT &&
+  process.env.SPACES_REGION &&
+  process.env.SPACES_KEY &&
+  process.env.SPACES_SECRET
+    ? new S3({
+        forcePathStyle: !!process.env.SPACES_FORCE_PATH_STYLE,
+        endpoint: process.env.SPACES_ENDPOINT,
+        region: process.env.SPACES_REGION,
+        credentials: {
+          accessKeyId: process.env.SPACES_KEY,
+          secretAccessKey: process.env.SPACES_SECRET,
+        },
+      })
+    : undefined;
+
+export default s3Client;

Securite/Linkwarden/lib/api/updateCustomerEmail.ts

@@ -0,0 +1,46 @@
+import Stripe from "stripe";
+
+export default async function updateCustomerEmail(
+  stripeSecretKey: string,
+  email: string,
+  newEmail: string
+) {
+  const stripe = new Stripe(stripeSecretKey, {
+    apiVersion: "2022-11-15",
+  });
+
+  const listByEmail = await stripe.customers.list({
+    email: email.toLowerCase(),
+    expand: ["data.subscriptions"],
+  });
+
+  const customer = listByEmail.data.find((customer, i) => {
+    const hasValidSubscription = customer.subscriptions?.data.some(
+      (subscription) => {
+        const NEXT_PUBLIC_TRIAL_PERIOD_DAYS =
+          process.env.NEXT_PUBLIC_TRIAL_PERIOD_DAYS;
+        const secondsInTwoWeeks = NEXT_PUBLIC_TRIAL_PERIOD_DAYS
+          ? Number(NEXT_PUBLIC_TRIAL_PERIOD_DAYS) * 86400
+          : 1209600;
+
+        const isNotCanceledOrHasTime = !(
+          subscription.canceled_at &&
+          new Date() >
+            new Date((subscription.canceled_at + secondsInTwoWeeks) * 1000)
+        );
+
+        return subscription?.items?.data[0].plan && isNotCanceledOrHasTime;
+      }
+    );
+
+    return (
+      customer.email?.toLowerCase() === email.toLowerCase() &&
+      hasValidSubscription
+    );
+  });
+
+  if (customer)
+    await stripe.customers.update(customer?.id, {
+      email: newEmail.toLowerCase(),
+    });
+}

Securite/Linkwarden/lib/api/validateUrlSize.ts

@@ -0,0 +1,25 @@
+import fetch from "node-fetch";
+import https from "https";
+
+export default async function validateUrlSize(url: string) {
+  try {
+    const httpsAgent = new https.Agent({
+      rejectUnauthorized:
+        process.env.IGNORE_UNAUTHORIZED_CA === "true" ? false : true,
+    });
+
+    const response = await fetch(url, {
+      method: "HEAD",
+      agent: httpsAgent,
+    });
+
+    const totalSizeMB =
+      Number(response.headers.get("content-length")) / Math.pow(1024, 2);
+    if (totalSizeMB > (Number(process.env.NEXT_PUBLIC_MAX_FILE_SIZE) || 30))
+      return null;
+    else return response.headers;
+  } catch (err) {
+    console.log(err);
+    return null;
+  }
+}

Securite/Linkwarden/lib/api/verifySubscription.ts

@@ -0,0 +1,73 @@
+import { prisma } from "./db";
+import { Subscription, User } from "@prisma/client";
+import checkSubscriptionByEmail from "./checkSubscriptionByEmail";
+
+interface UserIncludingSubscription extends User {
+  subscriptions: Subscription | null;
+}
+
+export default async function verifySubscription(
+  user?: UserIncludingSubscription
+) {
+  if (!user) {
+    return null;
+  }
+
+  const subscription = user.subscriptions;
+
+  const currentDate = new Date();
+
+  if (!subscription?.active || currentDate > subscription.currentPeriodEnd) {
+    const {
+      active,
+      stripeSubscriptionId,
+      currentPeriodStart,
+      currentPeriodEnd,
+    } = await checkSubscriptionByEmail(user.email as string);
+
+    if (
+      active &&
+      stripeSubscriptionId &&
+      currentPeriodStart &&
+      currentPeriodEnd
+    ) {
+      await prisma.subscription
+        .upsert({
+          where: {
+            userId: user.id,
+          },
+          create: {
+            active,
+            stripeSubscriptionId,
+            currentPeriodStart: new Date(currentPeriodStart),
+            currentPeriodEnd: new Date(currentPeriodEnd),
+            userId: user.id,
+          },
+          update: {
+            active,
+            stripeSubscriptionId,
+            currentPeriodStart: new Date(currentPeriodStart),
+            currentPeriodEnd: new Date(currentPeriodEnd),
+          },
+        })
+        .catch((err) => console.log(err));
+    } else if (!active) {
+      const subscription = await prisma.subscription.findFirst({
+        where: {
+          userId: user.id,
+        },
+      });
+
+      if (subscription)
+        await prisma.subscription.delete({
+          where: {
+            userId: user.id,
+          },
+        });
+
+      return null;
+    }
+  }
+
+  return user;
+}

Securite/Linkwarden/lib/api/verifyToken.ts

@@ -0,0 +1,36 @@
+import { NextApiRequest } from "next";
+import { JWT, getToken } from "next-auth/jwt";
+import { prisma } from "./db";
+
+type Props = {
+  req: NextApiRequest;
+};
+
+export default async function verifyToken({
+  req,
+}: Props): Promise<JWT | string> {
+  const token = await getToken({ req });
+  const userId = token?.id;
+
+  if (!userId) {
+    return "You must be logged in.";
+  }
+
+  if (token.exp < Date.now() / 1000) {
+    return "Your session has expired, please log in again.";
+  }
+
+  // check if token is revoked
+  const revoked = await prisma.accessToken.findFirst({
+    where: {
+      token: token.jti,
+      revoked: true,
+    },
+  });
+
+  if (revoked) {
+    return "Your session has expired, please log in again.";
+  }
+
+  return token;
+}

Securite/Linkwarden/lib/api/verifyUser.ts

@@ -0,0 +1,67 @@
+import { NextApiRequest, NextApiResponse } from "next";
+import { prisma } from "./db";
+import { User } from "@prisma/client";
+import verifySubscription from "./verifySubscription";
+import verifyToken from "./verifyToken";
+
+type Props = {
+  req: NextApiRequest;
+  res: NextApiResponse;
+};
+
+const STRIPE_SECRET_KEY = process.env.STRIPE_SECRET_KEY;
+
+export default async function verifyUser({
+  req,
+  res,
+}: Props): Promise<User | null> {
+  const token = await verifyToken({ req });
+
+  if (typeof token === "string") {
+    res.status(401).json({ response: token });
+    return null;
+  }
+
+  const userId = token?.id;
+
+  const user = await prisma.user.findUnique({
+    where: {
+      id: userId,
+    },
+    include: {
+      subscriptions: true,
+    },
+  });
+  const ssoUser = await prisma.account.findFirst({
+    where: {
+      userId: userId,
+    },
+  });
+
+  if (!user) {
+    res.status(404).json({ response: "User not found." });
+    return null;
+  }
+
+  if (!user.username && !ssoUser) {
+    // SSO users don't need a username
+    res.status(401).json({
+      response: "Username not found.",
+    });
+    return null;
+  }
+
+  if (STRIPE_SECRET_KEY) {
+    const subscribedUser = await verifySubscription(user);
+
+    if (!subscribedUser) {
+      res.status(401).json({
+        response:
+          "You are not a subscriber, feel free to reach out to us at support@linkwarden.app if you think this is an issue.",
+      });
+      return null;
+    }
+  }
+
+  return user;
+}