Josep Piguillem
8bf7d47b2e
A project member can be a GUEST. In a private project a guest only sees the tickets they take part in (opened, assigned or followed): every other ticket answers 404, also in my work, realtime changes, blockers and linked tickets, and project-wide views (activity, statistics, dashboard, releases, sprints, epics, trash) answer 403. Guests open tickets without assigning or planning them, and comment, attach, follow and vote on their own; they change nothing else. In a public project they see what anyone does. The web gives them only Tablero, Lista and Miembros and loads none of the project-wide data. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
20 lines
645 B
TypeScript
20 lines
645 B
TypeScript
import { IQueryHandler, QueryHandler } from '@nestjs/cqrs';
|
|
import { ReadAccess } from './read-access';
|
|
import { CanViewProjectQuery } from './can-view-project.query';
|
|
|
|
@QueryHandler(CanViewProjectQuery)
|
|
export class CanViewProjectQueryHandler
|
|
implements IQueryHandler<CanViewProjectQuery, boolean>
|
|
{
|
|
constructor(private readonly access: ReadAccess) {}
|
|
|
|
async execute(query: CanViewProjectQuery): Promise<boolean> {
|
|
if (!(await this.access.canView(query.projectId, query.viewerId)))
|
|
return false;
|
|
return (
|
|
!query.wholeProject ||
|
|
!(await this.access.participantScope(query.projectId, query.viewerId))
|
|
);
|
|
}
|
|
}
|