feat: adjust safepage endpoint (#154)

schibsted · Feb 7, 2024 · d01602c · d01602c
1 parent d46c925
commit d01602c
Showing 1 changed file with 24 additions and 15 deletions.
diff --git a/server/app.js b/server/app.js
@@ -65,21 +65,30 @@ app.get('/userinfo', (req, res) => {
 
 app.get('/isloggedin', (req, res) => res.send({ isLoggedin: req.isAuthenticated() }));
 
-app.get('/safepage', oauth.passport.authenticate('oauth'), asyncMW(async (req, res, next) => {
-    const state = {};
-    if (req.query.state) {
-        const stateString = Buffer.from(req.query.state, 'base64').toString();
-        Object.assign(state, JSON.parse(stateString));
-    }
-    if (req.query.order_id) {
-        console.log('Congratulations! You purchased something');
-    }
-    if (state.popup) {
-        res.render('safepage');
-    } else {
-        res.redirect('/');
-    }
-}));
+app.get('/safepage',
+    (req, res, next)=>{
+        if(!req.query.state || !req.query.code){
+            return res.redirect('/');
+        }
+
+        return next();
+    },
+    oauth.passport.authenticate('oauth'),
+    asyncMW(async (req, res, next) => {
+        const state = {};
+        if (req.query.state) {
+            const stateString = Buffer.from(req.query.state, 'base64').toString();
+            Object.assign(state, JSON.parse(stateString));
+        }
+        if (req.query.order_id) {
+            console.log('Congratulations! You purchased something');
+        }
+        if (state.popup) {
+            res.render('safepage');
+        } else {
+            res.redirect('/');
+        }
+    }));
 
 app.get('/session-exchange-safepage', oauth.passport.authenticate('oauth'), asyncMW(async (req, res) => {
     const state = {};