fix: add additional validation on legacy nonce value

fixes #169

Porting code forwards from an older revision of the codebase; https://github.com/revoltchat/backend/blob/0.5.3-alpha.10/src/database/entities/server.rs

Cargo.lock

@@ -2505,7 +2505,7 @@ dependencies = [
 [[package]]
 name = "rauth"
 version = "1.0.0"
-source = "git+https://github.com/insertish/rauth?rev=fee1e906c3726e6f0bdf9314508bd8a8e071ab4a#fee1e906c3726e6f0bdf9314508bd8a8e071ab4a"
+source = "git+https://github.com/insertish/rauth?rev=ab7cc5a9739f1147375d3a559250f4be2a051565#ab7cc5a9739f1147375d3a559250f4be2a051565"
 dependencies = [
  "async-std",
  "async-trait",
@@ -2986,7 +2986,7 @@ dependencies = [
 [[package]]
 name = "rocket_rauth"
 version = "1.0.0"
-source = "git+https://github.com/insertish/rauth?rev=fee1e906c3726e6f0bdf9314508bd8a8e071ab4a#fee1e906c3726e6f0bdf9314508bd8a8e071ab4a"
+source = "git+https://github.com/insertish/rauth?rev=ab7cc5a9739f1147375d3a559250f4be2a051565#ab7cc5a9739f1147375d3a559250f4be2a051565"
 dependencies = [
  "okapi",
  "rauth",

crates/delta/Cargo.toml

@@ -52,7 +52,7 @@ mobc-redis = { version = "0.7.0", default-features = false, features = ["async-s
 # web
 rocket = { version = "0.5.0-rc.2", default-features = false, features = ["json"] }
 rocket_empty = { git = "https://github.com/insertish/rocket_empty", branch = "master" }
-rocket_rauth = { git = "https://github.com/insertish/rauth", rev = "fee1e906c3726e6f0bdf9314508bd8a8e071ab4a" }
+rocket_rauth = { git = "https://github.com/insertish/rauth", rev = "ab7cc5a9739f1147375d3a559250f4be2a051565" }
 
 # spec generation
 schemars = "0.8.8"

crates/delta/src/routes/channels/message_send.rs

@@ -21,6 +21,7 @@ pub struct DataMessageSend {
     /// Unique token to prevent duplicate message sending
     ///
     /// **This is deprecated and replaced by `Idempotency-Key`!**
+    #[validate(length(min = 1, max = 64))]
     nonce: Option<String>,
 
     /// Message content to send

crates/quark/Cargo.toml

@@ -84,7 +84,7 @@ rocket_empty = { optional = true, git = "https://github.com/insertish/rocket_emp
 rocket_cors = { optional = true, git = "https://github.com/lawliet89/rocket_cors", rev = "5843861a88958c16bfaa0b40f0d8910772bcd2f6" }
 
 # rAuth
-rauth = { git = "https://github.com/insertish/rauth", rev = "fee1e906c3726e6f0bdf9314508bd8a8e071ab4a", features = [ "async-std-runtime" ] }
+rauth = { git = "https://github.com/insertish/rauth", rev = "ab7cc5a9739f1147375d3a559250f4be2a051565", features = [ "async-std-runtime" ] }
 
 # Sentry
 sentry = "0.25.0"

crates/quark/src/impl/generic/channels/channel.rs

@@ -242,7 +242,12 @@ impl Channel {
     /// Add user to a group
     pub async fn add_user_to_group(&mut self, db: &Database, user: &str, by: &str) -> Result<()> {
         if let Channel::Group { recipients, .. } = self {
-            recipients.push(user.to_string());
+            let user = user.to_string();
+            if recipients.contains(&user) {
+                return Err(Error::AlreadyInGroup);
+            }
+
+            recipients.push(user);
         }
 
         match &self {

crates/quark/src/impl/mongo/channels/channel_unread.rs

@@ -37,30 +37,46 @@ impl AbstractChannelUnread for MongoDb {
     }
 
     async fn acknowledge_channels(&self, user: &str, channels: &[String]) -> Result<()> {
+        let current_time = Ulid::new().to_string();
+
         self.col::<Document>(COL)
-            .update_one(
+            .delete_many(
                 doc! {
                     "_id.channel": {
                         "$in": channels
                     },
-                    "_id.user": user,
+                    "_id.user": user
                 },
-                doc! {
-                    "$unset": {
-                        "mentions": 1_i32
-                    },
-                    "$set": {
-                        "last_id": Ulid::new().to_string()
-                    }
-                },
-                UpdateOptions::builder().upsert(true).build(),
+                None,
             )
             .await
-            .map(|_| ())
             .map_err(|_| Error::DatabaseError {
-                operation: "update",
-                with: "channel_unread",
+                operation: "delete_many",
+                with: "channel_unreads",
+            })?;
+
+        self.col::<Document>(COL)
+            .insert_many(
+                channels
+                    .iter()
+                    .map(|channel| {
+                        doc! {
+                            "_id": {
+                                "channel": channel,
+                                "user": user
+                            },
+                            "last_id": &current_time
+                        }
+                    })
+                    .collect::<Vec<Document>>(),
+                None,
+            )
+            .await
+            .map_err(|_| Error::DatabaseError {
+                operation: "update_many",
+                with: "channel_unreads",
             })
+            .map(|_| ())
     }
 
     async fn add_mention_to_unread<'a>(