feat: App Stream, load on startup, new route added

api/src/controllers/drive.ts

@@ -29,6 +29,7 @@ import { getTmpFilesFolderPath } from '../utils'
 
 interface DeployPayload {
   appLoc: string
+  streamWebFolder?: string
   fileTree: FileTree
 }
 
@@ -190,14 +191,23 @@ const getFileTree = () => {
 }
 
 const deploy = async (data: DeployPayload) => {
+  const driveFilesPath = getTmpFilesFolderPath()
+
+  const appLocParts = data.appLoc.replace(/^\//, '').split('/')
+
+  const appLocPath = path
+    .join(getTmpFilesFolderPath(), ...appLocParts)
+    .replace(new RegExp('/', 'g'), path.sep)
+
+  if (!appLocPath.includes(driveFilesPath)) {
+    throw new Error('appLoc cannot be outside drive.')
+  }
+
   if (!isFileTree(data.fileTree)) {
     throw { code: 400, ...invalidDeployFormatResponse }
   }
 
-  await createFileTree(
-    data.fileTree.members,
-    data.appLoc.replace(/^\//, '').split('/')
-  ).catch((err) => {
+  await createFileTree(data.fileTree.members, appLocParts).catch((err) => {
     throw { code: 500, ...execDeployErrorResponse, ...err }
   })