feat: xss protection middleware

.gitignore

@@ -33,3 +33,4 @@ yarn.lock
 bun.lockb
 test.js
 .vscode
+bun.lockb

Dockerfile

@@ -0,0 +1,39 @@
+# syntax = docker/dockerfile:1
+
+# Adjust NODE_VERSION as desired
+ARG NODE_VERSION=18.20.0
+FROM node:${NODE_VERSION}-slim as base
+
+LABEL fly_launch_runtime="Node.js"
+
+# Node.js app lives here
+WORKDIR /app
+
+# Set production environment
+ENV NODE_ENV="production"
+
+
+# Throw-away build stage to reduce size of final image
+FROM base as build
+
+# Install packages needed to build node modules
+RUN apt-get update -qq && \
+apt-get install --no-install-recommends -y build-essential node-gyp pkg-config python-is-python3
+
+# Install node modules
+COPY --link package-lock.json package.json ./
+RUN npm ci
+
+# Copy application code
+COPY --link . .
+
+
+# Final stage for app image
+FROM base
+
+# Copy built application
+COPY --from=build /app /app
+
+# Start the server by default, this can be overwritten at runtime
+EXPOSE 3000
+CMD [ "npm", "run", "start" ]

components/choices/index.js

@@ -1,3 +1,4 @@
+const mongoose = require("mongoose");
 const express = require("express");
 const md5 = require("md5");
 // This will help us connect to the database
@@ -15,6 +16,7 @@ const DAOModel = require("../../db/models/Dao.model");
 const TokenModel = require("../../db/models/Token.model");
 const PollModel = require("../../db/models/Poll.model");
 const ChoiceModel = require("../../db/models/Choice.model");
+const { getEthUserBalanceAtLevel } = require("../../utils-eth");
 
 // This help convert the id from string to ObjectId for the _id.
 const ObjectId = require("mongodb").ObjectId;
@@ -60,8 +62,13 @@ const updateChoiceById = async (req, response) => {
       if (timeNow > Number(poll.endTime)) {
         throw new Error("Proposal Already Ended");
       }
-
-      const dao = await DAOModel.findById(poll.daoID)
+      const daoFindQuery = {}
+      if(mongoose.isValidObjectId(poll.daoID)){
+        daoFindQuery._id = poll.daoID
+      } else {
+        daoFindQuery.address = { $regex: new RegExp(`^${poll.daoID}$`, 'i') };
+      }
+      const dao = await DAOModel.findOne(daoFindQuery)
       if (!dao) throw new Error(`DAO not found: ${poll.daoID}`)
 
       const token = await TokenModel.findOne({ tokenAddress: dao.tokenAddress })
@@ -82,24 +89,17 @@ const updateChoiceById = async (req, response) => {
       );
       if (duplicates.length > 0) throw new Error("Duplicate choices found");
 
-      // TODO: Check if the user has enough balance to vote
-      // const total = await getUserTotalVotingPowerAtReferenceBlock(
-      //   dao.network,
-      //   dao.tokenAddress,
-      //   dao.daoContract,
-      //   token.tokenID,
-      //   block,
-      //   address,
-      //   poll.isXTZ
-      // );
-
-      // if (!total) {
-      //   throw new Error("Could not get total power at reference block");
-      // }
+      const total = await getEthUserBalanceAtLevel(dao.network || network, address, dao.tokenAddress, block)
+      console.log("EthTotal_UserBalance: ", total)
+
+      if (!total) {
+        throw new Error("Could not get total power at reference block");
+      }
 
       // if (total.eq(0)) {
       //   throw new Error("No balance at proposal level");
       // }
+
       const isVoted = await ChoiceModel.find({
         pollId: poll._id,
         walletAddresses: { $elemMatch: { address: address } }
@@ -108,8 +108,7 @@ const updateChoiceById = async (req, response) => {
 
       const walletVote = {
         address,
-        balanceAtReferenceBlock: 1,
-        // balanceAtReferenceBlock: total.toString(),
+        balanceAtReferenceBlock: total.toString(),
         payloadBytes,
         payloadBytesHash: md5(payloadBytes),
         signature,

components/daos/index.js

@@ -9,7 +9,7 @@ const {
 } = require("../../utils");
 const {
   getEthTokenHoldersCount,
-  getEthCurrentBlock,
+  getEthCurrentBlockNumber,
   getEthUserBalanceAtLevel,
   getEthTokenMetadata,
 } = require("../../utils-eth");
@@ -18,7 +18,7 @@ const dbo = require("../../db/conn");
 const { getPkhfromPk } = require("@taquito/utils");
 const DaoModel = require("../../db/models/Dao.model");
 const TokenModel = require("../../db/models/Token.model");
-
+const PollModel = require("../../db/models/Poll.model");
 const getAllLiteOnlyDAOs = async (req, response) => {
   const network = req.body?.network || req.query.network;
 
@@ -41,6 +41,7 @@ const getAllLiteOnlyDAOs = async (req, response) => {
       return {
         _id: dao._id,
         ...dao,
+        description: dao.description?.replace(/<[^>]*>/g, ''),
         ...token
       }
     });
@@ -102,6 +103,7 @@ const getDAOFromContractAddress = async (req, response) => {
         _id: result._id,
         ...token,
         ...result,
+        description: result.description?.replace(/<[^>]*>/g, ''),
       };
 
       return response.json(newResult);
@@ -118,10 +120,33 @@ const getDAOFromContractAddress = async (req, response) => {
 
 const getDAOById = async (req, response) => {
   const { id } = req.params;
-  const daoDao = await DaoModel.findById(id);
-  console.log({ id, daoDao })
+  const include = req.query.include
+  const query = {}
+  if(mongoose.isValidObjectId(id)) {
+    query._id = new mongoose.Types.ObjectId(id);
+  } else {
+    //  query.type = "onchain";
+    query.address = { $regex: new RegExp(`^${id}$`, 'i') };
+  }
+  let daoDao =  await DaoModel.findOne(query)
+  daoDao = await daoDao.toObject()
+
+  if(include === "polls"){
+
+    console.log("Include Polls")
+    const pollIds = daoDao.polls.map(poll => poll._id);
+    console.log("Poll IDs", pollIds)
+
+    const polls = await PollModel.find({ daoID: { $regex: new RegExp(`^${id}$`, 'i') } }).populate('choices').lean();
+    console.log("Polls", polls)
+
+    daoDao.polls = polls;
+  }
   if (daoDao) {
-    return response.json(daoDao);
+    return response.json({
+      ...daoDao,
+      description: daoDao.description?.replace(/<[^>]*>/g, ''),
+    });
   }
 
   try {
@@ -239,7 +264,7 @@ const createDAO = async (req, response) => {
 
     const address = publicKey
 
-    const block = await getEthCurrentBlock(network);
+    const block = await getEthCurrentBlockNumber(network);
     const userBalanceAtCurrentLevel = await getEthUserBalanceAtLevel(
       network,
       address,