feat: protect feedback screenshots

2026-04-30 13:15:19 -04:00
parent cb6948aa14
commit 4873f39192
24 changed files with 1900 additions and 0 deletions
--- a/backend/src/Socialize.Api/Modules/Feedback/Handlers/GetFeedbackScreenshot.cs
+++ b/backend/src/Socialize.Api/Modules/Feedback/Handlers/GetFeedbackScreenshot.cs
@@ -0,0 +1,65 @@
+using FastEndpoints;
+using Microsoft.EntityFrameworkCore;
+using Socialize.Api.Data;
+using Socialize.Api.Infrastructure.BlobStorage.Contracts;
+using Socialize.Api.Infrastructure.Security;
+using Socialize.Api.Modules.Feedback.Data;
+using Socialize.Api.Modules.Feedback.Services;
+using Socialize.Api.Modules.Identity.Contracts;
+
+namespace Socialize.Api.Modules.Feedback.Handlers;
+
+public class GetFeedbackScreenshotHandler(
+    AppDbContext dbContext,
+    IBlobStorage blobStorage)
+    : EndpointWithoutRequest<Stream>
+{
+    public override void Configure()
+    {
+        Get("/api/feedback/{id}/screenshot");
+        Options(o => o.WithTags("Feedback"));
+    }
+
+    public override async Task HandleAsync(CancellationToken ct)
+    {
+        Guid id = Route<Guid>("id");
+        Guid userId = User.GetUserId();
+
+        FeedbackReport? report = await dbContext.FeedbackReports
+            .Include(candidate => candidate.Screenshot)
+            .SingleOrDefaultAsync(candidate => candidate.Id == id, ct);
+
+        if (report is null || report.Screenshot is null)
+        {
+            await SendNotFoundAsync(ct);
+            return;
+        }
+
+        if (!FeedbackAccessRules.CanAccessScreenshot(report, userId, User.IsInRole(KnownRoles.Developer)))
+        {
+            await SendForbiddenAsync(ct);
+            return;
+        }
+
+        MemoryStream stream;
+        try
+        {
+            stream = await blobStorage.DownloadFileAsync(
+                report.Screenshot.BlobContainerName,
+                report.Screenshot.BlobName,
+                ct);
+        }
+        catch (FileNotFoundException)
+        {
+            await SendNotFoundAsync(ct);
+            return;
+        }
+
+        await SendStreamAsync(
+            stream,
+            fileName: report.Screenshot.FileName,
+            fileLengthBytes: report.Screenshot.SizeBytes,
+            contentType: report.Screenshot.ContentType,
+            cancellation: ct);
+    }
+}