feat: harden sessions and track downstream acknowledgements

api/src/channels/channels.controller.ts

@@ -1,5 +1,6 @@
 import { Body, Controller, Delete, Get, Param, Post, Put, Query } from '@nestjs/common';
 import { ApiTags } from '@nestjs/swagger';
+import { RequireRecentAuthentication } from '../auth/require-recent-authentication.decorator';
 import {
   ChannelsService,
   ChangeChannelStatusDto,
@@ -31,31 +32,37 @@ export class ChannelsController {
   }
 
   @Post('channels')
+  @RequireRecentAuthentication()
   createChannel(@Body() body: CreateChannelDto) {
     return this.channels.createChannel(body);
   }
 
   @Put('channels/:id')
+  @RequireRecentAuthentication()
   updateChannel(@Param('id') channelId: string, @Body() body: UpdateChannelDto) {
     return this.channels.updateChannel(channelId, body);
   }
 
   @Post('channels/:id/test')
+  @RequireRecentAuthentication()
   testChannel(@Param('id') channelId: string, @Body() body: TestChannelDto) {
     return this.channels.testChannel(channelId, body);
   }
 
   @Post('channels/:id/status')
+  @RequireRecentAuthentication()
   changeChannelStatus(@Param('id') channelId: string, @Body() body: ChangeChannelStatusDto) {
     return this.channels.changeChannelStatus(channelId, body);
   }
 
   @Post('channels/:id/copy')
+  @RequireRecentAuthentication()
   copyChannel(@Param('id') channelId: string, @Body() body: CopyChannelDto) {
     return this.channels.copyChannel(channelId, body);
   }
 
   @Delete('channels/:id')
+  @RequireRecentAuthentication()
   deleteChannel(@Param('id') channelId: string, @Body() body: ChangeChannelStatusDto) {
     return this.channels.deleteChannel(channelId, body);
   }
@@ -96,21 +103,25 @@ export class ChannelsController {
   }
 
   @Post('channel-groups')
+  @RequireRecentAuthentication()
   createGroup(@Body() body: CreateChannelGroupDto) {
     return this.channels.createGroup(body);
   }
 
   @Put('channel-groups/:id')
+  @RequireRecentAuthentication()
   updateGroup(@Param('id') groupId: string, @Body() body: UpdateChannelGroupDto) {
     return this.channels.updateGroup(groupId, body);
   }
 
   @Delete('channel-groups/:id')
+  @RequireRecentAuthentication()
   deleteGroup(@Param('id') groupId: string) {
     return this.channels.deleteGroup(groupId);
   }
 
   @Post('channel-groups/items')
+  @RequireRecentAuthentication()
   addGroupItem(@Body() body: CreateChannelGroupItemDto) {
     return this.channels.addGroupItem(body);
   }
@@ -121,6 +132,7 @@ export class ChannelsController {
   }
 
   @Post('channel-route-rules')
+  @RequireRecentAuthentication()
   createRouteRule(@Body() body: CreateRouteRuleDto) {
     return this.channels.createRouteRule(body);
   }
@@ -156,6 +168,7 @@ export class ChannelsController {
   }
 
   @Post('report-tasks/status-change')
+  @RequireRecentAuthentication()
   changeReportTaskStatuses(@Body() body: ChangeReportTaskStatusesDto) {
     return this.channels.changeReportTaskStatuses(body);
   }