0.57.17

package-lock.json

@@ -1,11 +1,11 @@
 {
   "name": "traxxx-web",
-  "version": "0.57.16",
+  "version": "0.57.17",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
-      "version": "0.57.16",
+      "version": "0.57.17",
       "dependencies": {
         "@brillout/json-serializer": "^0.5.25",
         "@dicebear/collection": "7.0.5",

package.json

@@ -92,7 +92,7 @@
   "overrides": {
     "vite": "$vite"
   },
-  "version": "0.57.16",
+  "version": "0.57.17",
   "imports": {
     "#/*": "./*.js"
   },

src/auth.js

@@ -628,6 +628,14 @@ export async function verifyKey(userId, key, req) {
 		throw new HttpError('The API credentials are not provided.', 401);
 	}
 
+	if (typeof userId !== 'number') {
+		throw new HttpError('User ID is not a number', 400);
+	}
+
+	if (typeof key !== 'string') {
+		throw new HttpError('Key is not a string', 400);
+	}
+
 	const hashedKey = (await scrypt(key, '', 64)).toString('hex'); // salt redundant for randomly generated key
 
 	const storedKey = await knex('users_keys')

src/web/graphql.js

@@ -112,7 +112,7 @@ export async function graphqlApi(req, res) {
 		return;
 	}
 
-	await verifyKey(req.headers['api-user'], req.headers['api-key'], req);
+	await verifyKey(Number(req.headers['api-user']), req.headers['api-key'], req);
 
 	req.user = {
 		id: Number(req.headers['api-user']),

src/web/scenes.js

@@ -131,6 +131,7 @@ export const scenesSchema = `
 		network: Entity
 		actors: [Actor!]!
 		tags: [Tag!]!
+		chapters: [Chapter!]!
 		poster: Media
 		trailer: Media
 		photos: [Media!]!
@@ -160,6 +161,16 @@ export const scenesSchema = `
 		size: Int
 		createdAt: Int
 	}
+
+	type Chapter {
+		id: Int!
+		time: Int!
+		tags: [Tag!]!
+		date: Date
+		description: String
+		title: String
+		poster: Media
+	}
 `;
 
 function getScope(query) {

src/web/server.js

@@ -119,7 +119,7 @@ export default async function initServer() {
 
 	router.use('/api/{*splat}', async (req, _res, next) => {
 		if (req.headers['api-user']) {
-			req.user = await verifyKey(req.headers['api-user'], req.headers['api-key'], req);
+			req.user = await verifyKey(Number(req.headers['api-user']), req.headers['api-key'], req);
 		}
 
 		next();