fix: гонки (транзакции), валидатор (суперсеть, parseInt, слэши), auth (401, DEV_MODE, export), схема (UNIQUE, CHECK, FK), client-валидация

2026-05-30 08:28:21 +03:00
parent 60972169c5
commit 51f2f4ddaf
5 changed files with 164 additions and 108 deletions
@@ -4,11 +4,11 @@ const { validate, overlaps } = require('./validators');
 // ── Companies ──

 async function getOrCreateCompany(clientId, companyName) {
-  let res = await pool.query('SELECT * FROM companies WHERE client_id = $1', [clientId]);
-  if (res.rows.length > 0) return res.rows[0];
-
-  res = await pool.query(
-    'INSERT INTO companies (client_id, name) VALUES ($1, $2) RETURNING *',
+  // Атомарный upsert — исключает дубли компаний при параллельных запросах
+  const res = await pool.query(
+    `INSERT INTO companies (client_id, name) VALUES ($1, $2)
+     ON CONFLICT (client_id) DO UPDATE SET name = COALESCE(companies.name, EXCLUDED.name)
+     RETURNING *`,
    [clientId, companyName || clientId]
  );
  return res.rows[0];
@@ -16,7 +16,8 @@ async function getOrCreateCompany(clientId, companyName) {

 async function getLimit(company) {
  const defaultLimit = parseInt(process.env.DEFAULT_LIMIT, 10) || 15;
-  return company.custom_limit || defaultLimit;
+  // != null: custom_limit = 0 не должен превращаться в defaultLimit
+  return company.custom_limit != null ? company.custom_limit : defaultLimit;
 }

 // ── Entries ──
@@ -30,100 +31,133 @@ async function listEntries(companyId, includeDeleted = false) {

 async function createEntry(companyId, rawValue, comment, userEmail) {
  const { cidr, wasNormalized } = validate(rawValue);
+  const client = await pool.connect();
+  try {
+    await client.query('BEGIN');
+    // Блокировка строки компании — сериализует параллельные вставки
+    const company = (await client.query(
+      'SELECT * FROM companies WHERE id = $1 FOR UPDATE', [companyId]
+    )).rows[0];
+    if (!company) throw new Error('Компания не найдена');

-  // Проверка лимита
-  const company = (await pool.query('SELECT * FROM companies WHERE id = $1', [companyId])).rows[0];
-  const limit = await getLimit(company);
-  const cnt = (await pool.query(
-    'SELECT COUNT(*)::int AS c FROM whitelist_entries WHERE company_id = $1 AND deleted_at IS NULL',
-    [companyId]
-  )).rows[0].c;
+    const limit = await getLimit(company);
+    const cnt = (await client.query(
+      'SELECT COUNT(*)::int AS c FROM whitelist_entries WHERE company_id = $1 AND deleted_at IS NULL',
+      [companyId]
+    )).rows[0].c;
+    if (cnt >= limit) throw new Error(`Лимит исчерпан: ${cnt} из ${limit}`);

-  if (cnt >= limit) throw new Error(`Лимит исчерпан: ${cnt} из ${limit}`);
+    // Проверка дубликатов и пересечений
+    const existing = (await client.query(
+      'SELECT value_cidr FROM whitelist_entries WHERE company_id = $1 AND deleted_at IS NULL',
+      [companyId]
+    )).rows;
+    for (const row of existing) {
+      if (row.value_cidr === cidr) throw new Error('Такой адрес уже существует');
+      if (overlaps(cidr, row.value_cidr))
+        throw new Error(`Пересечение с существующей записью ${row.value_cidr}`);
+    }

-  // Проверка дубликатов и пересечений
-  const existing = (await pool.query(
-    'SELECT value_cidr FROM whitelist_entries WHERE company_id = $1 AND deleted_at IS NULL',
-    [companyId]
-  )).rows;
-
-  for (const row of existing) {
-    if (row.value_cidr === cidr) throw new Error('Такой адрес уже существует');
-    if (overlaps(cidr, row.value_cidr))
-      throw new Error(`Пересечение с существующей записью ${row.value_cidr}`);
+    const res = await client.query(
+      `INSERT INTO whitelist_entries (company_id, value_cidr, comment, created_by)
+       VALUES ($1, $2, $3, $4) RETURNING *`,
+      [companyId, cidr, comment || null, userEmail]
+    );
+    await logAudit(userEmail, companyId, 'CREATE', null, cidr, res.rows[0].id, client);
+    await client.query('COMMIT');
+    return { entry: res.rows[0], wasNormalized };
+  } catch (e) {
+    await client.query('ROLLBACK');
+    throw e;
+  } finally {
+    client.release();
  }
-
-  const res = await pool.query(
-    `INSERT INTO whitelist_entries (company_id, value_cidr, comment, created_by)
-     VALUES ($1, $2, $3, $4) RETURNING *`,
-    [companyId, cidr, comment || null, userEmail]
-  );
-
-  // Аудит
-  await logAudit(userEmail, companyId, 'CREATE', null, cidr, res.rows[0].id);
-
-  return { entry: res.rows[0], wasNormalized };
 }

 async function updateEntry(entryId, companyId, rawValue, comment, userEmail) {
-  const old = (await pool.query(
-    'SELECT * FROM whitelist_entries WHERE id = $1 AND company_id = $2 AND deleted_at IS NULL',
-    [entryId, companyId]
-  )).rows[0];
-  if (!old) throw new Error('Запись не найдена');
-
  const { cidr, wasNormalized } = validate(rawValue);
+  const client = await pool.connect();
+  try {
+    await client.query('BEGIN');
+    // Блокировка строки компании — сериализует параллельные обновления
+    await client.query('SELECT * FROM companies WHERE id = $1 FOR UPDATE', [companyId]);

-  // Проверка пересечений (исключая саму себя)
-  const existing = (await pool.query(
-    'SELECT value_cidr FROM whitelist_entries WHERE company_id = $1 AND deleted_at IS NULL AND id <> $2',
-    [companyId, entryId]
-  )).rows;
-  for (const row of existing) {
-    if (row.value_cidr === cidr) throw new Error('Такой адрес уже существует');
-    if (overlaps(cidr, row.value_cidr))
-      throw new Error(`Пересечение с существующей записью ${row.value_cidr}`);
+    const old = (await client.query(
+      'SELECT * FROM whitelist_entries WHERE id = $1 AND company_id = $2 AND deleted_at IS NULL',
+      [entryId, companyId]
+    )).rows[0];
+    if (!old) throw new Error('Запись не найдена');
+
+    // Проверка пересечений (исключая саму себя)
+    const existing = (await client.query(
+      'SELECT value_cidr FROM whitelist_entries WHERE company_id = $1 AND deleted_at IS NULL AND id <> $2',
+      [companyId, entryId]
+    )).rows;
+    for (const row of existing) {
+      if (row.value_cidr === cidr) throw new Error('Такой адрес уже существует');
+      if (overlaps(cidr, row.value_cidr))
+        throw new Error(`Пересечение с существующей записью ${row.value_cidr}`);
+    }
+
+    const res = await client.query(
+      `UPDATE whitelist_entries SET value_cidr = $1, comment = $2, updated_by = $3, updated_at = NOW()
+       WHERE id = $4 AND company_id = $5 RETURNING *`,
+      [cidr, comment || old.comment, userEmail, entryId, companyId]
+    );
+    await logAudit(userEmail, companyId, 'UPDATE', old.value_cidr, cidr, entryId, client);
+    await client.query('COMMIT');
+    return { entry: res.rows[0], wasNormalized };
+  } catch (e) {
+    await client.query('ROLLBACK');
+    throw e;
+  } finally {
+    client.release();
  }
-
-  const res = await pool.query(
-    `UPDATE whitelist_entries SET value_cidr = $1, comment = $2, updated_by = $3, updated_at = NOW()
-     WHERE id = $4 AND company_id = $5 RETURNING *`,
-    [cidr, comment || old.comment, userEmail, entryId, companyId]
-  );
-
-  await logAudit(userEmail, companyId, 'UPDATE', old.value_cidr, cidr, entryId);
-
-  return { entry: res.rows[0], wasNormalized };
 }

 async function deleteEntry(entryId, companyId, userEmail) {
-  const old = (await pool.query(
-    'SELECT * FROM whitelist_entries WHERE id = $1 AND company_id = $2 AND deleted_at IS NULL',
-    [entryId, companyId]
-  )).rows[0];
-  if (!old) throw new Error('Запись не найдена');
+  const client = await pool.connect();
+  try {
+    await client.query('BEGIN');

-  await pool.query(
-    'UPDATE whitelist_entries SET deleted_by = $1, deleted_at = NOW() WHERE id = $2',
-    [userEmail, entryId]
-  );
+    const old = (await client.query(
+      'SELECT * FROM whitelist_entries WHERE id = $1 AND company_id = $2 AND deleted_at IS NULL',
+      [entryId, companyId]
+    )).rows[0];
+    if (!old) throw new Error('Запись не найдена');

-  await logAudit(userEmail, companyId, 'DELETE', old.value_cidr, null, entryId);
+    // company_id в WHERE — глубина защиты от случайной утечки между компаниями
+    await client.query(
+      'UPDATE whitelist_entries SET deleted_by = $1, deleted_at = NOW() WHERE id = $2 AND company_id = $3',
+      [userEmail, entryId, companyId]
+    );
+    await logAudit(userEmail, companyId, 'DELETE', old.value_cidr, null, entryId, client);
+    await client.query('COMMIT');
+  } catch (e) {
+    await client.query('ROLLBACK');
+    throw e;
+  } finally {
+    client.release();
+  }
 }

 // ── Export ──

-async function getExportCIDRs() {
-  const rows = (await pool.query(
-    'SELECT value_cidr FROM whitelist_entries WHERE deleted_at IS NULL ORDER BY value_cidr'
-  )).rows;
-  return rows.map(r => r.value_cidr);
+async function getExportCIDRs(companyId = null) {
+  let sql = 'SELECT value_cidr FROM whitelist_entries WHERE deleted_at IS NULL';
+  const params = [];
+  if (companyId) {
+    sql += ' AND company_id = $1';
+    params.push(companyId);
+  }
+  sql += ' ORDER BY value_cidr';
+  return ((await pool.query(sql, params)).rows).map(r => r.value_cidr);
 }

 // ── Audit ──

-async function logAudit(userEmail, companyId, action, oldValue, newValue, entryId) {
-  await pool.query(
+async function logAudit(userEmail, companyId, action, oldValue, newValue, entryId, db = pool) {
+  await db.query(
    `INSERT INTO audit_log (user_email, company_id, action, old_value, new_value, entry_id)
     VALUES ($1, $2, $3, $4, $5, $6)`,
    [userEmail, companyId, action, oldValue, newValue, entryId || null]