G35x Comments - Answer Overflow

G35x

Posts Comments

WWasp

•Created by Gus on 3/28/2025 in #🙋questions

How can I prevent google login to automatically login with the latest chosen account?

@Gus Carlos & Vinny solved it 👆 👆

20 replies

WWasp

•Created by G35x on 3/31/2025 in #🙋questions

TanStack Tables with WASP?

Thanks @Vinny (@Wasp)! I was kinda sorta hoping someone would tell me there's a compatibility issue/talk me out of this. May the coding gods have mercy on my refactor 🙏 🤣

8 replies

WWasp

•Created by Gus on 3/28/2025 in #🙋questions

How can I prevent google login to automatically login with the latest chosen account?

Yep definitely learned something new! Thanks for correcting me 🙂

20 replies

WWasp

•Created by Gus on 3/28/2025 in #🙋questions

How can I prevent google login to automatically login with the latest chosen account?

Would be cool, as a workaround to solve this UX issue, if a user could authenticate multiple Google accounts to the same user entity for the WASP webapp auth, but this would probably require extensive reworking of how WASP's pre-build Auth works, as well as non trivial changes to the user dashboard, sign in screen, account creation screen. Also have the issue of figuring out how to attribute a new Gaccount w/ an existing user.. would likely need to require a user to register with a phone number + email in the registration screen THEN give them the option to create the account w/ a password OR sign-in with Google. Then for any subsequent logins, the first step for the user would always be for the user to enter their phone number/email AND then: -> check for existing Google auth --> if true and user is signed into the correct account = successful login. --> if true and user is NOT signed into the correct account = allow them to use their existing Gauth account OR associate a new Gaccount w/ their user, however, you'd then need to send 2fa confirmation link to the original phone number/email prior to new Gaccount association = success, lest anyone could just register auth to an existing account. One consideration I'd definitely make when designing this process is ensuring account enumeration can't be achieved through any of the dialogue in the login process. IMO, it's more work than it's worth, but would be super cool!

20 replies

WWasp

•Created by Gus on 3/28/2025 in #🙋questions

How can I prevent google login to automatically login with the latest chosen account?

@Gus I think this is more of a Google Oauth scope than WASP, I could be wrong, but from all of the Google services I use.. the only time I have the chance to choose which account to "sign in" w/ Google auth, is when I'm signed out of my google account / my Google session has expired. I have this issue all the time when sharing access restricted Google sheets w/ clients who have multiple Gaccounts in their browser. They complain that they can't access the resources and I have to explain they'll need to make sure they're not signed into any other accounts/if they are, they need to change the browser profile to the Gaccount with access. I had this exact issue when building a Google Workspace Marketplace plugin in the past too.. while there was no "login" page for the plugin, setting the scope & google Oauth config was very much the same. The plugin sometimes wouldn't work/show up in the Google sheet if the user was signed into more than one google account at a time, depending on what account Google detected as the currently signed in "default" account for Oauth. Same deal, had to explain to end-users to make sure they've signed out of any other account prior to using the plugin if they're getting 403 issues/the plugin disappears. If I'm wrong, pls let me know!

20 replies

WWasp

•Created by fred-123 on 3/24/2025 in #🙋questions

Is it possible to create custom user roles with the current wasp auth? Such as non-admin staff

That's what I'm looking for 😄 +1 :boi: from me to support this future plan I'm brooding over having to figure this out but would love to have "team" admins for my users & role based access within teams.

8 replies

WWasp

•Created by pipas on 3/18/2025 in #🙋questions

Best practices to verify files before uploading to S3?

Hey @pipas , probably good to do some server-side validation depending on your security requirements, like checking the MIME type and throwing an error if 'application/pdf' is not met. I haven't done this with my own WASP project but you could modify the the s3utils file from the template to do something like this (GPT generated so this won't work as is) import * as fs from 'fs'; import * as fileType from 'file-type'; // other imports // existing s3utils code const allowedMimeTypes = ['application/pdf']; // Specify allowed MIME types // Function to check the MIME type of the uploaded file const checkMimeType = async (filePath: string): Promise<boolean> => { const buffer = fs.readFileSync(filePath); // Read file content into a buffer const type = await fileType.fromBuffer(buffer); // Detect MIME type based on content
if (!type) { console.log('File type could not be determined'); return false; // Unable to determine MIME type } return allowedMimeTypes.includes(type.mime); // Check if it's an allowed MIME type }; export const getUploadFileSignedURLFromS3 = async ({ fileName, fileType, userId }: S3Upload) => { const tempFilePath = /tmp/${fileName}; // Assuming the file is being uploaded to a temporary location const isValidMimeType = await checkMimeType(tempFilePath); if (!isValidMimeType) { throw new Error('Invalid MIME type'); } // rest of your s3utils code You could also add some additional integrity checks to read portions of the PDFs and verify it isn't malformed/is structured as a PDF to verify the content matches the MIME type since this could be spoofed. If you're worried about malicious uploads, you could even use VirusTotal API to programatically scan files before storing them in your S3 bucket, but there could be privacy considerations to account for in doing so.

15 replies

WWasp

•Created by G35x on 3/9/2025 in #🙋questions

/app/src/client VS /app/src/server?

Smart adding this to curssorrules. This might solve a big problem I've been having with Cursor since that update a couple weeks ago.. it's been taking some creative liberties and creating files in erroneous locations so this might tighten up the performance

20 replies

WWasp

•Created by G35x on 3/9/2025 in #🙋questions

/app/src/client VS /app/src/server?

@genyus this was actually extremely helpful to see! Thank you for sharing.. Do you use a VS plugin to make a file tree? How'd you generate this? Sry for late reply, been working on a DSP plugin. Working with raw C++ really makes me appreciate how great/easy to use WASP is 🥹

20 replies

WWasp

•Created by G35x on 3/9/2025 in #🙋questions

/app/src/client VS /app/src/server?

@sodic this is such a goldmine of information for me in my situation. I appreciate you taking the time to understand where I am in my understanding and give me threads to pull on and learn from. Not only did you give me the "WHAT" in what I was looking for, but the "WHY". Tree shaking is on my to-do list today to dig into, and I'll need to figure out how to know what not to import into the client code. The project I'm working on is what some of my developer friends have called "ambitious".. to put it lightly. And it very well may deal with sensitive (but non-regulated) user data so I really want to take my time and understand this fully. Before I launch I plan to do some solo pentesting before I contract out an audit to a 3p, so if you have any resources or any other "threads" I can pull on related to secure coding practices I'd be very thankful!

20 replies

WWasp

•Created by G35x on 3/9/2025 in #🙋questions

/app/src/client VS /app/src/server?

@genyus Really appreciate the feedback! I've been organizing by feature so far and trying my best not to abstract the codebase too much. Deciding what is really a standalone feature vs what is a sub-feature (and won't be used in another domain) isn't always easy but I think I'm finally finding a rhythm. I will typically build out a large feature, then refactor, then finally refine the UI/UX before moving on. Main goals of my refactors are to eliminate redundancy, create common utilities, and generally keeping files under 300 lines (within reason). The main issue is, I was worried I'm exposing something sensitive within the client that should be part of the server. Thankfully, the WASP team is smarter than I am and thought of that already haha! from what I've gathered, grouping the operations.ts files inside of the directory for any given feature isn't a cardinal sin and may even lend to easier maintenance in the future.

20 replies

WWasp