Josep Piguillem
71dc2d6f2d
- Query DTO properties with a default value (limit, offset, days, perColumn, assignedToMe, search, archived, requiresReason, force) were documented as `object` in openapi.json, which broke generated clients. They now declare their type explicitly. - Reading a private project, ticket, release or its comments without access answered "Project <internal id> not found", confirming the project exists. ReadAccess now reports what the caller asked for (e2e covered). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
56 lines
1.8 KiB
TypeScript
56 lines
1.8 KiB
TypeScript
import { Injectable } from '@nestjs/common';
|
|
import { NotFoundError } from '@task-stream/api/shared/domain';
|
|
import { ProjectRole } from '@task-stream/api/tracker/domain';
|
|
import { FindProjectsRepository } from '../ports/find-projects.repository';
|
|
|
|
/**
|
|
* Authorisation for the read side, based on the projected memberships:
|
|
* members read their projects; anyone (also anonymous, `viewerId` null)
|
|
* reads public ones.
|
|
*/
|
|
@Injectable()
|
|
export class ReadAccess {
|
|
constructor(private readonly findProjects: FindProjectsRepository) {}
|
|
|
|
/**
|
|
* The viewer's role, or null when they read a public project as an outsider.
|
|
* `asked` is what the caller looked for: the error names it, never the
|
|
* project behind it (that would confirm a private project exists).
|
|
*/
|
|
async assertCanView(
|
|
projectId: string,
|
|
viewerId: string | null,
|
|
asked: { entity: string; ref: string } = {
|
|
entity: 'Project',
|
|
ref: projectId,
|
|
},
|
|
): Promise<ProjectRole | null> {
|
|
const role = viewerId
|
|
? await this.findProjects.findRole(projectId, viewerId)
|
|
: null;
|
|
if (role) return role;
|
|
const project = await this.findProjects.findById(projectId);
|
|
// Same answer for "doesn't exist" and "not yours": don't leak projects.
|
|
if (!project?.isPublic) throw new NotFoundError(asked.entity, asked.ref);
|
|
return null;
|
|
}
|
|
|
|
async canView(projectId: string, viewerId: string | null): Promise<boolean> {
|
|
try {
|
|
await this.assertCanView(projectId, viewerId);
|
|
return true;
|
|
} catch (error) {
|
|
if (error instanceof NotFoundError) return false;
|
|
throw error;
|
|
}
|
|
}
|
|
|
|
assertFound<T>(value: T | null, entity: string, id: string): T {
|
|
if (!value) throw new NotFoundError(entity, id);
|
|
return value;
|
|
}
|
|
}
|
|
|
|
export const UUID =
|
|
/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
|