From 66c372558ee8a5a7fa4c00f10dc34ff4787fd1e7 Mon Sep 17 00:00:00 2001 From: kptdobe Date: Fri, 3 Oct 2025 09:50:34 +0200 Subject: [PATCH] fix(versionsource): "delegate" permission check to api --- src/utils/auth.js | 2 +- test/utils/auth.test.js | 15 ++++++++++++++- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/src/utils/auth.js b/src/utils/auth.js index 69aaaf7a..63b999b8 100644 --- a/src/utils/auth.js +++ b/src/utils/auth.js @@ -297,7 +297,7 @@ export async function getAclCtx(env, org, users, key, api) { // Expose the action trace or not? actionTrace = users.every((u) => aclTrace.includes(u.email)) ? actionTrace : undefined; - if (k === 'CONFIG') { + if (k === 'CONFIG' || api === 'versionsource') { actionSet.add('read'); } diff --git a/test/utils/auth.test.js b/test/utils/auth.test.js index 485aabfa..401b4f6e 100644 --- a/test/utils/auth.test.js +++ b/test/utils/auth.test.js @@ -302,7 +302,20 @@ describe('DA auth', () => { const users = [{email: "blah@foo.org"}]; const aclCtx = await getAclCtx(env2, 'test', users, '/', 'config'); assert(aclCtx.actionSet.has('read')); - }) + }); + + it('test versionsource api always has read permission', async () => { + const users = [{email: "blah@foo.org"}]; + const aclCtx = await getAclCtx(env2, 'test', users, '/', 'versionsource'); + assert(aclCtx.actionSet.has('read')); + }); + + it('test versionsource api grants read permission even without explicit permissions', async () => { + const users = [{email: "unauthorized@example.com"}]; + const aclCtx = await getAclCtx(env2, 'test', users, '/restricted', 'versionsource'); + assert(aclCtx.actionSet.has('read')); + assert(!aclCtx.actionSet.has('write')); + }); }); describe('persmissions single sheet', () => {