Add sentry to api (#460)

* add sentry to API

* better capture errors instead of failing

* add @sentry/tracing to package mgr

* fix file access error

quadratic-api/src/helpers/get_file.ts

@@ -3,11 +3,19 @@ import { PrismaClient, QUser } from '@prisma/client';
 const prisma = new PrismaClient();
 
 export const get_file = async (user: QUser, uuid: string) => {
-  // Get the file from the database, only if it exists and the user owns it
-  return await prisma.qFile.findFirst({
+  // Get the file from the database by uuid
+  const file = await prisma.qFile.findFirst({
     where: {
-      qUserId: user.id, // important to prevent users from getting access to files they don't own
       uuid,
     },
   });
+
+  if (!file) return null;
+
+  // only return the file if the user is the owner
+  if (user.id === file.qUserId) {
+    return file;
+  }
+
+  throw new Error('File owner does not match user request');
 };

quadratic-api/src/index.ts

@@ -63,14 +63,6 @@ if (SENTRY_DSN) {
 
   // The error handler must be before any other error middleware and after all controllers
   app.use(Sentry.Handlers.errorHandler());
-
-  // Optional fallthrough error handler
-  app.use((err: any, req: Request, res: any, next: NextFunction) => {
-    // The error id is attached to `res.sentry` to be returned
-    // and optionally displayed to the user for support.
-    res.statusCode = 500;
-    res.end(res.sentry + '\n');
-  });
 }
 
 // Error-logging middleware