From 7f40b62f7d44f62dbb3fea23d02c80d0091eede7 Mon Sep 17 00:00:00 2001
From: Bernd Storath <999999bst@gmail.com>
Date: Mon, 3 Mar 2025 11:55:37 +0100
Subject: [PATCH] verify setup step

---
 src/server/api/setup/2.post.ts       |  5 ++---
 src/server/api/setup/4.post.ts       |  5 +++--
 src/server/api/setup/migrate.post.ts |  2 +-
 src/server/middleware/setup.ts       |  2 +-
 src/server/utils/handler.ts          | 29 ++++++++++++++++++++++++++++
 5 files changed, 36 insertions(+), 7 deletions(-)

diff --git a/src/server/api/setup/2.post.ts b/src/server/api/setup/2.post.ts
index ae1e1b29..29c0c769 100644
--- a/src/server/api/setup/2.post.ts
+++ b/src/server/api/setup/2.post.ts
@@ -1,14 +1,13 @@
 import { UserSetupSchema } from '#db/repositories/user/types';
 
-export default defineSetupEventHandler(async ({ event }) => {
+export default defineSetupEventHandler(2, async ({ event }) => {
   const { username, password } = await readValidatedBody(
     event,
     validateZod(UserSetupSchema, event)
   );
 
-  // TODO: validate setup step
-
   await Database.users.create(username, password);
+
   await Database.general.setSetupStep(3);
   return { success: true };
 });
diff --git a/src/server/api/setup/4.post.ts b/src/server/api/setup/4.post.ts
index 593fc1b0..192fce38 100644
--- a/src/server/api/setup/4.post.ts
+++ b/src/server/api/setup/4.post.ts
@@ -1,12 +1,13 @@
 import { UserConfigSetupSchema } from '#db/repositories/userConfig/types';
 
-export default defineSetupEventHandler(async ({ event }) => {
+export default defineSetupEventHandler(4, async ({ event }) => {
   const { host, port } = await readValidatedBody(
     event,
     validateZod(UserConfigSetupSchema, event)
   );
-  // TODO: validate setup step
+
   await Database.userConfigs.updateHostPort(host, port);
+
   await Database.general.setSetupStep(0);
   return { success: true };
 });
diff --git a/src/server/api/setup/migrate.post.ts b/src/server/api/setup/migrate.post.ts
index 2567ddfc..febd0702 100644
--- a/src/server/api/setup/migrate.post.ts
+++ b/src/server/api/setup/migrate.post.ts
@@ -2,7 +2,7 @@ import { parseCidr } from 'cidr-tools';
 import { stringifyIp } from 'ip-bigint';
 import { z } from 'zod';
 
-export default defineSetupEventHandler(async ({ event }) => {
+export default defineSetupEventHandler('migrate', async ({ event }) => {
   const { file } = await readValidatedBody(
     event,
     validateZod(FileSchema, event)
diff --git a/src/server/middleware/setup.ts b/src/server/middleware/setup.ts
index 9cda7b15..c0db75b1 100644
--- a/src/server/middleware/setup.ts
+++ b/src/server/middleware/setup.ts
@@ -1,4 +1,4 @@
-/* First setup of wg-easy app */
+/* First setup of wg-easy */
 export default defineEventHandler(async (event) => {
   const url = getRequestURL(event);
 
diff --git a/src/server/utils/handler.ts b/src/server/utils/handler.ts
index 60167956..79e1f435 100644
--- a/src/server/utils/handler.ts
+++ b/src/server/utils/handler.ts
@@ -63,6 +63,17 @@ export const definePermissionEventHandler = <
   });
 };
 
+// which api route is allowed for each setup step
+// 0 is done, 1 is start
+// 3 means step 2 is done
+const ValidSetupSteps = {
+  1: [2] as const,
+  3: [4, 'migrate'] as const,
+} as const;
+
+type ValidSteps =
+  (typeof ValidSetupSteps)[keyof typeof ValidSetupSteps][number];
+
 type SetupHandler<
   TReq extends EventHandlerRequest,
   TRes extends EventHandlerResponse,
@@ -75,6 +86,7 @@ export const defineSetupEventHandler = <
   TReq extends EventHandlerRequest,
   TRes extends EventHandlerResponse,
 >(
+  step: ValidSteps,
   handler: SetupHandler<TReq, TRes>
 ) => {
   return defineEventHandler(async (event) => {
@@ -87,6 +99,23 @@ export const defineSetupEventHandler = <
       });
     }
 
+    const validSetupSteps =
+      ValidSetupSteps[setup.step as keyof typeof ValidSetupSteps];
+
+    if (!validSetupSteps) {
+      throw createError({
+        statusCode: 500,
+        statusMessage: 'Invalid setup step',
+      });
+    }
+
+    if (!validSetupSteps.includes(step as never)) {
+      throw createError({
+        statusCode: 400,
+        statusMessage: 'Invalid step',
+      });
+    }
+
     return await handler({ event, setup });
   });
 };