60 lines
2.1 KiB
JavaScript
60 lines
2.1 KiB
JavaScript
import { Router } from 'express'
|
|
import { readFileSync, writeFileSync, existsSync } from 'fs'
|
|
import { join, dirname } from 'path'
|
|
import { fileURLToPath } from 'url'
|
|
import { Mutex } from 'async-mutex'
|
|
import { resourceLimiter } from '../middleware/rateLimiter.js'
|
|
import { antiSpam } from '../middleware/antiSpam.js'
|
|
|
|
const __dirname = dirname(fileURLToPath(import.meta.url))
|
|
const LEADS_FILE = join(__dirname, '..', 'data', 'leads.json')
|
|
const leadsMutex = new Mutex()
|
|
|
|
// Only alphanumeric + hyphen resource IDs are allowed. This prevents path
|
|
// traversal (e.g. "../../etc/passwd") when building the download URL.
|
|
const RESOURCE_ID_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/
|
|
|
|
function loadLeads() {
|
|
if (!existsSync(LEADS_FILE)) return []
|
|
try { return JSON.parse(readFileSync(LEADS_FILE, 'utf-8')) }
|
|
catch { return [] }
|
|
}
|
|
|
|
function saveLeads(leads) {
|
|
writeFileSync(LEADS_FILE, JSON.stringify(leads, null, 2), 'utf-8')
|
|
}
|
|
|
|
const router = Router()
|
|
|
|
router.post('/', resourceLimiter, antiSpam, async (req, res) => {
|
|
const { name, email, company, resource_id } = req.body
|
|
const errors = {}
|
|
if (!name || name.trim().length === 0) errors.name = 'Name ist erforderlich.'
|
|
if (name && name.length > 100) errors.name = 'Max. 100 Zeichen.'
|
|
if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) errors.email = 'Gültige E-Mail erforderlich.'
|
|
if (!company || company.trim().length === 0) errors.company = 'Unternehmen ist erforderlich.'
|
|
if (company && company.length > 150) errors.company = 'Max. 150 Zeichen.'
|
|
if (!resource_id || !RESOURCE_ID_PATTERN.test(resource_id)) errors.resource_id = 'Ungültige Resource-ID.'
|
|
|
|
if (Object.keys(errors).length > 0) {
|
|
return res.status(400).json({ errors })
|
|
}
|
|
|
|
await leadsMutex.runExclusive(async () => {
|
|
const leads = loadLeads()
|
|
leads.push({
|
|
name,
|
|
email,
|
|
company,
|
|
resource_id,
|
|
timestamp: new Date().toISOString(),
|
|
})
|
|
saveLeads(leads)
|
|
})
|
|
|
|
// Return download URL (resource files are in public/resources/)
|
|
res.json({ ok: true, download_url: `/resources/${resource_id}.pdf` })
|
|
})
|
|
|
|
export default router
|