- block file link generation when it contains reported files (#174)

- set default folder from api
- fix builds

Author: aaspinwall

README.md

@@ -26,6 +26,8 @@ Install the package managers `bun` and `pnpm` globally. You can do this using np
 ```sh
 npm install -g bun
 npm install -g pnpm
+# This step is optional if you don't have lerna installed globally but it's easier to run commands that use it
+pnpm install -g lerna
 ```
 
 Or alternatively

packages/send/backend/prisma/migrations/20250910130100_add_default_folder_field/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "Container" ADD COLUMN     "isDefault" BOOLEAN NOT NULL DEFAULT false;

packages/send/backend/prisma/schema.prisma

@@ -190,6 +190,7 @@ model Container {
   children  Container[]     @relation("Nesting")
 
   tags      Tag[]
+  isDefault Boolean     @default(false) // Whether this is the user's default folder
 }
 
 enum ItemType {

packages/send/backend/src/models/containers.ts

@@ -105,7 +105,7 @@ export async function getContainerWithAncestors(id: string) {
 }
 
 export async function getContainerWithoutAncestors(userId: string) {
-  const topLevelContainers = prisma.container.findFirst({
+  const topLevelContainers = prisma.container.findMany({
     where: {
       parent: { is: null },
       owner: { id: userId },
@@ -114,6 +114,31 @@ export async function getContainerWithoutAncestors(userId: string) {
   return topLevelContainers;
 }
 
+export async function setContainerAsDefault(
+  container: string,
+  ownerId: string
+) {
+  return await prisma.container.update({
+    where: {
+      id: container,
+      ownerId,
+    },
+    data: {
+      isDefault: true,
+      updatedAt: new Date(),
+    },
+  });
+}
+
+export async function getDefaultContainerForOwner(ownerId: string) {
+  return await prisma.container.findFirst({
+    where: {
+      ownerId,
+      isDefault: true,
+    },
+  });
+}
+
 export async function getAccessLinksForContainer(containerId: string) {
   const shares = await fromPrismaV2(prisma.share.findMany, {
     where: {

packages/send/backend/src/models/sharing.ts

@@ -833,3 +833,21 @@ export async function deleteAccessLink(linkId: string) {
 export async function burnEphemeralConversation(containerId: string) {
   return await burnFolder(containerId);
 }
+
+export async function checkIfAccessLinkCanBeCreated(containerId: string) {
+  const reportedUploads = await prisma.container.findUnique({
+    where: { id: containerId },
+    select: {
+      items: {
+        where: {
+          upload: {
+            is: {
+              reported: true,
+            },
+          },
+        },
+      },
+    },
+  });
+  return reportedUploads?.items.length === 0;
+}

packages/send/backend/src/routes/sharing.ts

@@ -4,6 +4,7 @@ import {
   acceptAccessLink,
   acceptInvitation,
   burnEphemeralConversation,
+  checkIfAccessLinkCanBeCreated,
   createAccessLink,
   createInvitationFromAccessLink,
   getAccessLinkChallenge,
@@ -23,7 +24,10 @@ import {
 
 import { getDataFromAuthenticatedRequest } from '@send-backend/auth/client';
 import { useMetrics } from '@send-backend/metrics';
-import { addExpiryToContainer } from '@send-backend/utils';
+import {
+  addExpiryToContainer,
+  formatAccessLinkWithPasswordHash,
+} from '@send-backend/utils';
 import {
   getGroupMemberPermissions,
   requireAdminPermission,
@@ -95,6 +99,17 @@ router.post(
     if (req.body.permission) {
       permission = req.body.permission;
     }
+
+    // check if link can be created
+    const canCreateLink = await checkIfAccessLinkCanBeCreated(containerId);
+
+    if (!canCreateLink) {
+      return res.status(403).json({
+        message:
+          'Cannot create access link for this container because it contains files that have been reported for abuse.',
+      });
+    }
+
     const accessLink = await createAccessLink(
       containerId,
       senderId,
@@ -126,6 +141,20 @@ router.post(
   })
 );
 
+router.get(
+  '/:containerId/canCreateAccessLink',
+  requireJWT,
+  getGroupMemberPermissions,
+  requireSharePermission,
+  wrapAsyncHandler(async (req, res) => {
+    const { containerId } = req.params;
+    const canCreateLink = await checkIfAccessLinkCanBeCreated(containerId);
+    return res.status(200).json({
+      canCreateLink,
+    });
+  })
+);
+
 /**
  * @openapi
  * /api/sharing/accept/{invitationId}:
@@ -307,10 +336,12 @@ router.get(
 
     if (type === 'file') {
       const result = await getAccessLinksByUploadIdAndWrappedKey(uploadId);
-      return res.status(200).json(result);
+      const formattedLinks = formatAccessLinkWithPasswordHash(result);
+      return res.status(200).json(formattedLinks);
     }
     const result = await getAccessLinksByUploadId(uploadId);
-    return res.status(200).json(result);
+    const formattedLinks = formatAccessLinkWithPasswordHash(result);
+    return res.status(200).json(formattedLinks);
   })
 );
 

packages/send/backend/src/trpc/containers.ts

@@ -6,6 +6,8 @@ import {
 import {
   getAccessLinksForContainer as getAccessLinks,
   getContainerWithoutAncestors,
+  getDefaultContainerForOwner,
+  setContainerAsDefault,
 } from '@send-backend/models/containers';
 import { getAllUserGroupContainers } from '@send-backend/models/users';
 import { addExpiryToContainer } from '@send-backend/utils';
@@ -211,9 +213,31 @@ export const containersRouter = router({
         id: '',
       };
 
+      // get the default folder for the user where the isDefault flag is true
+      const defaultFolder = await getDefaultContainerForOwner(id);
+      if (defaultFolder) {
+        response.id = defaultFolder.id;
+        return response;
+      }
+
+      // If we don't have a default folder, we need to get all the folders for the user and set oldest one as default
       try {
-        const containers = await getContainerWithoutAncestors(id);
-        response.id = containers.id;
+        const containersWithoutAncestors =
+          await getContainerWithoutAncestors(id);
+
+        // If the user has no folders at all, we just return an empty response
+        if (!containersWithoutAncestors.length) {
+          return response;
+        }
+
+        // Make sure we tag the first container (by creation date) as default so we don't have issues later
+        const sortedContainers = containersWithoutAncestors.sort((a, b) =>
+          a.createdAt > b.createdAt ? 1 : -1
+        );
+
+        await setContainerAsDefault(sortedContainers?.[0]?.id, id);
+        response.id = sortedContainers?.[0]?.id;
+
         return response;
       } catch {
         throw new TRPCError({

packages/send/backend/src/trpc/users.ts

@@ -181,7 +181,6 @@ export const usersRouter = router({
     )
     .subscription(async function* (opts) {
       if (!opts.ctx?.user?.id) {
-        console.error('Verification can only be done by logged for users');
         return;
       }
       // listen for new events
@@ -203,7 +202,6 @@ export const usersRouter = router({
     )
     .subscription(async function* (opts) {
       if (!opts.ctx?.user?.id) {
-        console.error('Verification can only be done by logged for users');
         return;
       }
       // listen for new events
@@ -230,7 +228,6 @@ export const usersRouter = router({
     )
     .subscription(async function* (opts) {
       if (!opts.ctx?.user?.id) {
-        console.error('Verification can only be done by logged for users');
         return;
       }
       // listen for new events

packages/send/backend/src/utils.ts

@@ -93,3 +93,17 @@ export const addExpiryToContainer = ({ createdAt, ...upload }: Upload) => {
     expired: daysToExpiry <= 0,
   };
 };
+type Shares = {
+  id: string;
+  passwordHash: string;
+  expiryDate: Date;
+  locked: boolean;
+};
+export const formatAccessLinkWithPasswordHash = (shares: Partial<Shares>[]) => {
+  return shares.map((link) => {
+    // If there password hash is present, we add it to the id so that the full shareable link can be shown to the user
+    return link.passwordHash
+      ? { ...link, id: link.id + `#${link.passwordHash}` }
+      : link;
+  });
+};

packages/send/frontend/src/apps/send/components/CreateAccessLink.vue

@@ -24,6 +24,7 @@ const tooltipText = ref('Copied to clipboard');
 const clipboard = useClipboard();
 const accessUrlInput = ref<HTMLInputElement | null>(null);
 const isLoading = ref(false);
+const errorMessage = ref('');
 
 const { mutate } = useMutation({
   mutationKey: ['getAccessLink'],
@@ -50,31 +51,39 @@ function copyToClipboard(url: string) {
 
 async function newAccessLink() {
   isLoading.value = true;
-  const url = await sharingStore.createAccessLink(
-    props.folderId,
-    password.value,
-    expiration.value
-  );
-
-  if (!url) {
+  try {
+    const url = await sharingStore.createAccessLink(
+      props.folderId,
+      password.value,
+      expiration.value
+    );
+
+    if (!url) {
+      emit('createAccessLinkError');
+      errorMessage.value = 'Failed to create access link. Please try again.';
+      isLoading.value = false;
+      return;
+    }
+
+    accessUrl.value = url;
+
+    if (!password.value.length) {
+      mutate();
+    }
+
+    // Copy url to clipboard
+    clipboard.copy(url);
+
+    // Focus the input
+    accessUrlInput.value?.focus();
+
+    await refreshAccessLinks();
+    isLoading.value = false;
+  } catch (error) {
     emit('createAccessLinkError');
-    return;
-  }
-
-  accessUrl.value = url;
-
-  if (!password.value.length) {
-    mutate();
+    errorMessage.value = error;
+    isLoading.value = false;
   }
-
-  // Copy url to clipboard
-  clipboard.copy(url);
-
-  // Focus the input
-  accessUrlInput.value?.focus();
-
-  await refreshAccessLinks();
-  isLoading.value = false;
 }
 
 watch(
@@ -84,6 +93,7 @@ watch(
     expiration.value = null;
     accessUrl.value = '';
     showPassword.value = false;
+    errorMessage.value = '';
   }
 );
 </script>
@@ -102,7 +112,6 @@ watch(
     </label>
     <label class="form-label">
       <span class="label-text">Link Expires</span>
-      <input v-model="expiration" type="datetime-local" />
     </label>
     <label class="form-label password-field">
       <span class="label-text">Password</span>
@@ -120,6 +129,12 @@ watch(
       </button>
     </label>
   </section>
+
+  <!-- Error message display -->
+  <div v-if="errorMessage" class="error-message" data-testid="error-message">
+    {{ errorMessage }}
+  </div>
+
   <Btn
     class="create-button"
     data-testid="create-share-link"
@@ -174,4 +189,14 @@ watch(
 .create-button {
   margin-bottom: 2rem;
 }
+
+.error-message {
+  background-color: #fee2e2;
+  border: 1px solid #fecaca;
+  color: #dc2626;
+  padding: 0.75rem;
+  border-radius: 0.375rem;
+  font-size: 0.875rem;
+  margin-bottom: 1rem;
+}
 </style>