From 23c53bd1af76de5c57f5c8caf68c1e023fb9f810 Mon Sep 17 00:00:00 2001
From: shuaiplus <2327005759@qq.com>
Date: Mon, 6 Jul 2026 15:38:52 +0800
Subject: [PATCH] fix: validate anonymous notification hub requests

---
 src/handlers/notifications.ts | 8 ++++++++
 src/router-public.ts          | 2 ++
 2 files changed, 10 insertions(+)

diff --git a/src/handlers/notifications.ts b/src/handlers/notifications.ts
index f978119..fecb822 100644
--- a/src/handlers/notifications.ts
+++ b/src/handlers/notifications.ts
@@ -1,4 +1,6 @@
 import { AuthService } from '../services/auth';
+import { StorageService } from '../services/storage';
+import { isAuthRequestExpired } from '../services/storage-auth-request-repo';
 import type { Env, JWTPayload } from '../types';
 import { errorResponse, jsonResponse } from '../utils/response';
 import { generateUUID } from '../utils/uuid';
@@ -65,6 +67,12 @@ export async function handleAnonymousNotificationsHub(request: Request, env: Env
     return errorResponse('Expected websocket', 426);
   }
 
+  const storage = new StorageService(env.DB);
+  const authRequest = await storage.getAuthRequestById(authRequestId);
+  if (!authRequest || isAuthRequestExpired(authRequest)) {
+    return errorResponse('Not found', 404);
+  }
+
   const id = env.NOTIFICATIONS_HUB.idFromName(authRequestId);
   const stub = env.NOTIFICATIONS_HUB.get(id);
   const forwardedUrl = new URL(request.url);
diff --git a/src/router-public.ts b/src/router-public.ts
index 74a7660..de13846 100644
--- a/src/router-public.ts
+++ b/src/router-public.ts
@@ -549,6 +549,8 @@ export async function handlePublicRoute(
   }
 
   if (path === '/notifications/anonymous-hub' && method === 'GET') {
+    const blocked = await enforcePublicRateLimit('public-sensitive', LIMITS.rateLimit.sensitivePublicRequestsPerMinute);
+    if (blocked) return blocked;
     return handleAnonymousNotificationsHub(request, env);
   }
   return null;