From b83be85e6ddc6d0a5a48887deb6bfa920353ba1e Mon Sep 17 00:00:00 2001
From: Ogulcan Gurcaglar <ogulcan@zeropath.com>
Date: Tue, 8 Sep 2026 11:20:25 +0300
Subject: [PATCH] feat(routes): add delivery estimate endpoint

---
 routes/deliveryEstimate.ts | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 routes/deliveryEstimate.ts

diff --git a/routes/deliveryEstimate.ts b/routes/deliveryEstimate.ts
new file mode 100644
index 00000000000..3eb3d3c46c9
--- /dev/null
+++ b/routes/deliveryEstimate.ts
@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
+ * SPDX-License-Identifier: MIT
+ */
+
+import * as models from '../models/index'
+import { type Request, type Response, type NextFunction } from 'express'
+import path from 'path'
+import fs from 'fs'
+
+const NOTES_ROOT = path.resolve('ftp/notes')
+
+// Delivery estimate for a given region, plus the courier's published notes.
+module.exports = function deliveryEstimate () {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const region = String(req.query.region ?? '')
+    models.sequelize.query(
+      'SELECT etaDays FROM Deliveries WHERE region = :region',
+      { replacements: { region }, type: models.sequelize.QueryTypes.SELECT }
+    ).then((rows: any) => {
+      const note = path.basename(String(req.query.note ?? 'default.txt'))
+      const resolved = path.join(NOTES_ROOT, note)
+      if (!resolved.startsWith(NOTES_ROOT + path.sep)) {
+        res.status(400).send('Invalid note.')
+        return
+      }
+      fs.readFile(resolved, 'utf8', (error, text) => {
+        if (error != null) {
+          next(error)
+          return
+        }
+        res.json({ region, rows, note: text.slice(0, 200) })
+      })
+    }).catch((error: Error) => {
+      next(error)
+    })
+  }
+}