From 0209d8bb886809a9184b821a6cbbbb6bef963f3c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20L=C3=B3pez=20Guimaraes?= <danielectra@outlook.com>
Date: Sun, 8 Jun 2025 23:51:07 +0100
Subject: [PATCH] fix: Reapply restriction for NNAS only allowing console
 tokens

---
 src/database.ts        | 21 +++++++++++++--------
 src/middleware/pnid.ts |  5 +++--
 2 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/src/database.ts b/src/database.ts
index cbee9bc..42ed024 100644
--- a/src/database.ts
+++ b/src/database.ts
@@ -104,12 +104,17 @@ export async function getPNIDByBasicAuth(token: string): Promise<HydratedPNIDDoc
 	return pnid;
 }
 
-export async function getPNIDByTokenAuth(token: string): Promise<HydratedPNIDDocument | null> {
+export async function getPNIDByTokenAuth(token: string, allowedTypes?: number[]): Promise<HydratedPNIDDocument | null> {
 	verifyConnected();
 
 	try {
 		const decryptedToken = decryptToken(Buffer.from(token, 'hex'));
 		const unpackedToken = unpackToken(decryptedToken);
+
+		if (allowedTypes && !allowedTypes.includes(unpackedToken.system_type)) {
+			return null;
+		}
+
 		const pnid = await getPNIDByPID(unpackedToken.pid);
 
 		if (pnid) {
@@ -221,8 +226,8 @@ export async function getServerByGameServerID(gameServerID: string, accessMode:
 
 	for (const mode of searchModes) {
 		const server = servers.find(s => s.access_mode === mode);
-		if (server) {
-			return server;
+		if (server) {
+			return server;
 		}
 	}
 
@@ -239,8 +244,8 @@ export async function getServerByTitleID(titleID: string, accessMode: string): P
 
 	for (const mode of searchModes) {
 		const server = servers.find(s => s.access_mode === mode);
-		if (server) {
-			return server;
+		if (server) {
+			return server;
 		}
 	}
 
@@ -257,8 +262,8 @@ export async function getServerByClientID(clientID: string, accessMode: string):
 
 	for (const mode of searchModes) {
 		const server = servers.find(s => s.access_mode === mode);
-		if (server) {
-			return server;
+		if (server) {
+			return server;
 		}
 	}
 
@@ -312,4 +317,4 @@ export async function removePNIDConnectionDiscord(pnid: HydratedPNIDDocument): P
 		app: 'api',
 		status: 200
 	};
-}
+}
diff --git a/src/middleware/pnid.ts b/src/middleware/pnid.ts
index 7312b18..e0c05f0 100644
--- a/src/middleware/pnid.ts
+++ b/src/middleware/pnid.ts
@@ -23,7 +23,8 @@ async function PNIDMiddleware(request: express.Request, response: express.Respon
 	if (type === 'Basic' && request.path.includes('v1/api/people/@me/devices')) {
 		pnid = await getPNIDByBasicAuth(token);
 	} else if (type === 'Bearer') {
-		pnid = await getPNIDByTokenAuth(token);
+		// TODO - This "accepted types list" is mostly a hack. Change this
+		pnid = await getPNIDByTokenAuth(token, [1, 2]);
 	}
 
 	if (!pnid) {
@@ -84,4 +85,4 @@ async function PNIDMiddleware(request: express.Request, response: express.Respon
 	return next();
 }
 
-export default PNIDMiddleware;
+export default PNIDMiddleware;