Rokojori
/
rojects
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Projects BugFix Update

This commit is contained in:
Rokojori 2026-07-14 15:29:53 +02:00
parent 99f6f787ec
commit d14c46307f
2 changed files with 19 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
source/server/projectAccess.ts
View File

@ -31,16 +31,14 @@ export function canEdit( project: Project, members: ProjectMember[], user: JwtUs
return role === 'editor' || role === 'admin'; return role === 'editor' || role === 'admin';
} }
export type AccessResult = export interface AccessDenial { status: number; error: string; }
| { ok: true }
| { ok: false; status: number; error: string };
export function checkAccess( projectId: string, user: JwtUser, mode: 'view' | 'edit' ): AccessResult export function checkAccess( projectId: string, user: JwtUser, mode: 'view' | 'edit' ): AccessDenial | null
{ {
const project = projects.findById( projectId ); const project = projects.findById( projectId );
if ( !project ) return { ok: false, status: 404, error: 'Not found' }; if ( !project ) return { status: 404, error: 'Not found' };
const members = projectMembers.forProject( projectId ); const members = projectMembers.forProject( projectId );
const allowed = mode === 'view' ? canView( project, members, user ) : canEdit( project, members, user ); const allowed = mode === 'view' ? canView( project, members, user ) : canEdit( project, members, user );
if ( !allowed ) return { ok: false, status: 403, error: 'Forbidden' }; if ( !allowed ) return { status: 403, error: 'Forbidden' };
return { ok: true }; return null;
} }

28
source/server/routes/files.ts
View File

@ -8,15 +8,15 @@ router.use( requireAuth );
router.get( '/:projectId/tree', ( req, res ) => router.get( '/:projectId/tree', ( req, res ) =>
{ {
const access = checkAccess( req.params.projectId, req.user!, 'view' ); const denied = checkAccess( req.params.projectId, req.user!, 'view' );
if ( !access.ok ) { res.status( access.status ).json( { error: access.error } ); return; } if ( denied ) { res.status( denied.status ).json( { error: denied.error } ); return; }
res.json( getFileTree( req.params.projectId ) ); res.json( getFileTree( req.params.projectId ) );
} ); } );
router.get( '/:projectId/*', ( req, res ) => router.get( '/:projectId/*', ( req, res ) =>
{ {
const access = checkAccess( req.params.projectId, req.user!, 'view' ); const denied = checkAccess( req.params.projectId, req.user!, 'view' );
if ( !access.ok ) { res.status( access.status ).json( { error: access.error } ); return; } if ( denied ) { res.status( denied.status ).json( { error: denied.error } ); return; }
const filePath = ( req.params as Record<string, string> )[ 0 ]; const filePath = ( req.params as Record<string, string> )[ 0 ];
const content = readProjectFile( req.params.projectId, filePath ); const content = readProjectFile( req.params.projectId, filePath );
if ( content === null ) { res.status( 404 ).json( { error: 'Not found' } ); return; } if ( content === null ) { res.status( 404 ).json( { error: 'Not found' } ); return; }
@ -25,8 +25,8 @@ router.get( '/:projectId/*', ( req, res ) =>
router.post( '/:projectId/create-file', ( req, res ) => router.post( '/:projectId/create-file', ( req, res ) =>
{ {
const access = checkAccess( req.params.projectId, req.user!, 'edit' ); const denied = checkAccess( req.params.projectId, req.user!, 'edit' );
if ( !access.ok ) { res.status( access.status ).json( { error: access.error } ); return; } if ( denied ) { res.status( denied.status ).json( { error: denied.error } ); return; }
const { path: filePath } = req.body as { path: string }; const { path: filePath } = req.body as { path: string };
if ( !filePath ) { res.status( 400 ).json( { error: 'path required' } ); return; } if ( !filePath ) { res.status( 400 ).json( { error: 'path required' } ); return; }
const ok = createProjectFile( req.params.projectId, filePath ); const ok = createProjectFile( req.params.projectId, filePath );
@ -36,8 +36,8 @@ router.post( '/:projectId/create-file', ( req, res ) =>
router.post( '/:projectId/create-directory', ( req, res ) => router.post( '/:projectId/create-directory', ( req, res ) =>
{ {
const access = checkAccess( req.params.projectId, req.user!, 'edit' ); const denied = checkAccess( req.params.projectId, req.user!, 'edit' );
if ( !access.ok ) { res.status( access.status ).json( { error: access.error } ); return; } if ( denied ) { res.status( denied.status ).json( { error: denied.error } ); return; }
const { path: dirPath } = req.body as { path: string }; const { path: dirPath } = req.body as { path: string };
if ( !dirPath ) { res.status( 400 ).json( { error: 'path required' } ); return; } if ( !dirPath ) { res.status( 400 ).json( { error: 'path required' } ); return; }
const ok = createProjectDirectory( req.params.projectId, dirPath ); const ok = createProjectDirectory( req.params.projectId, dirPath );
@ -47,8 +47,8 @@ router.post( '/:projectId/create-directory', ( req, res ) =>
router.post( '/:projectId/rename', ( req, res ) => router.post( '/:projectId/rename', ( req, res ) =>
{ {
const access = checkAccess( req.params.projectId, req.user!, 'edit' ); const denied = checkAccess( req.params.projectId, req.user!, 'edit' );
if ( !access.ok ) { res.status( access.status ).json( { error: access.error } ); return; } if ( denied ) { res.status( denied.status ).json( { error: denied.error } ); return; }
const { path: oldPath, newName } = req.body as { path: string; newName: string }; const { path: oldPath, newName } = req.body as { path: string; newName: string };
if ( !oldPath || !newName ) { res.status( 400 ).json( { error: 'path and newName required' } ); return; } if ( !oldPath || !newName ) { res.status( 400 ).json( { error: 'path and newName required' } ); return; }
const ok = renameProjectEntry( req.params.projectId, oldPath, newName ); const ok = renameProjectEntry( req.params.projectId, oldPath, newName );
@ -58,8 +58,8 @@ router.post( '/:projectId/rename', ( req, res ) =>
router.post( '/:projectId/delete', ( req, res ) => router.post( '/:projectId/delete', ( req, res ) =>
{ {
const access = checkAccess( req.params.projectId, req.user!, 'edit' ); const denied = checkAccess( req.params.projectId, req.user!, 'edit' );
if ( !access.ok ) { res.status( access.status ).json( { error: access.error } ); return; } if ( denied ) { res.status( denied.status ).json( { error: denied.error } ); return; }
const { path: targetPath } = req.body as { path: string }; const { path: targetPath } = req.body as { path: string };
if ( !targetPath ) { res.status( 400 ).json( { error: 'path required' } ); return; } if ( !targetPath ) { res.status( 400 ).json( { error: 'path required' } ); return; }
const ok = deleteProjectEntry( req.params.projectId, targetPath ); const ok = deleteProjectEntry( req.params.projectId, targetPath );
@ -69,8 +69,8 @@ router.post( '/:projectId/delete', ( req, res ) =>
router.put( '/:projectId/*', ( req, res ) => router.put( '/:projectId/*', ( req, res ) =>
{ {
const access = checkAccess( req.params.projectId, req.user!, 'edit' ); const denied = checkAccess( req.params.projectId, req.user!, 'edit' );
if ( !access.ok ) { res.status( access.status ).json( { error: access.error } ); return; } if ( denied ) { res.status( denied.status ).json( { error: denied.error } ); return; }
const filePath = ( req.params as Record<string, string> )[ 0 ]; const filePath = ( req.params as Record<string, string> )[ 0 ];
if ( typeof req.body !== 'string' ) { res.status( 400 ).json( { error: 'Content must be text' } ); return; } if ( typeof req.body !== 'string' ) { res.status( 400 ).json( { error: 'Content must be text' } ); return; }
const ok = writeProjectFile( req.params.projectId, filePath, req.body ); const ok = writeProjectFile( req.params.projectId, filePath, req.body );