Verify shelf id and request from external domain if present

app/views/shelves/controller.js

@@ -37,7 +37,7 @@ export class ShelvesController extends ViewController {
   }
 
   getTargetShelf () {
-    const target = this.targetShelf + (this.targetDomain !== null ? `/${this.targetDomain}` : '');
+    const target = this.targetShelf + '/' + (this.targetDomain !== null ? `${this.targetDomain}` : '');
     return fetch('/api/shelf/get/' + target).then(response => response.json()).then(shelf => {
       this.state.loadedShelves[this.targetShelf] = shelf;
     });

server/controllers/shelf.js

@@ -1,3 +1,5 @@
+import fetch from 'node-fetch';
+
 class ShelfController {
   constructor (shelfModel, shelfItemModel) {
     this.model = shelfModel;
@@ -22,6 +24,12 @@ class ShelfController {
     return true;
   }
 
+  async static CheckExternalDomainForShelf (domain, shelfId) {
+    const response = await fetch(`https://${domain}/api/shelf/get/${shelfId}/`).then(response => response.json());
+    // validate response somehow
+    return response;
+  }
+
   async createDefaultShelves (user) {
     try {
       const defaultShelvesCreated = await this.model.bulkCreate([

server/routes/shelf.js

@@ -34,6 +34,16 @@ async function routes(fastify, options) {
         message: 'api.shelf.get.missing_id',
       });
     }
+    if (isNaN(parseInt(request.params.shelfId))) {
+      return reply.code(400).send({
+        error: true,
+        message: 'api.shelf.get.invalid_id',
+      });
+    }
+
+    if (request.params.domain.trim() !== '') {
+      return ShelfController.CheckExternalDomainForShelf(request.params.domain.trim(), request.params.shelfId);
+    }
 
     const shelfController = new ShelfController(fastify.models.Shelf, fastify.models.ShelfItem);