crudy/pgmorbac-fastify
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

fix: list routes answer for permitted orgs only; org lists go through the hooks

Browse Source
This commit is contained in:
marc
2026-11-02 00:22:35 +01:00
parent bc05d312a6
commit 12964793cf
17 changed files with 179 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/routes/rule-cross-org.ts
+5 -4
View File
@@ -1,6 +1,6 @@
import type { FastifyInstance } from 'fastify';
import type { Pool } from 'pg';
import { getUser, getOrgScope, orgScopeExpr, hasPermission, isActivityViewBound, SYSTEM_ORG_ID } from '../permissions.js';
import { getUser, getOrgScope, orgScopeExpr, hasPermission, permittedScope, isActivityViewBound, SYSTEM_ORG_ID } from '../permissions.js';
import { crossOrgRuleResponse, notFound, forbidden, unauthorized, badRequest } from '../schemas.js';
export function createCrossOrgRuleRoutes(db: Pool) {
@@ -23,10 +23,11 @@ export function createCrossOrgRuleRoutes(db: Pool) {
const orgIds = getOrgScope(req, reply, false);
if (orgIds === null) return reply;
if (!await hasPermission(db, req, reply, orgIds[0] ?? null, 'read', 'cross_org_rules')) return reply;
const scope = await permittedScope(db, req, reply, orgIds, 'read', 'cross_org_rules');
if (!scope) return reply;
const { expr: srcExpr, params: srcParams } = orgScopeExpr(orgIds, 'cor.source_org_id');
const { expr: tgtExpr, params: tgtParams } = orgScopeExpr(orgIds, 'cor.target_org_id', srcParams.length);
const { expr: srcExpr, params: srcParams } = orgScopeExpr(scope, 'cor.source_org_id');
const { expr: tgtExpr, params: tgtParams } = orgScopeExpr(scope, 'cor.target_org_id', srcParams.length);
const where = srcExpr && tgtExpr ? `WHERE (${srcExpr} OR ${tgtExpr})`
: srcExpr ? `WHERE ${srcExpr}`
: tgtExpr ? `WHERE ${tgtExpr}`