⚠️ Potential issue | 🟠 Major
Token-based access should be evaluated before user role, or treated equivalently to reporter.
The checkAccess logic authorizes authenticated users first and falls through to the token check. Combined with getComments (Lines 62–67), this creates a subtle information-disclosure gap:
An authenticated INVESTIGATOR (or any non-admin authenticated user) who is not assigned to this ticket but possesses the reporter token will be authorized via the token branch. In getComments, isReporter is false and isAnonymous is false, so they receive all comments including internalNote=true entries — which a bona-fide reporter using the same token would be filtered away from.
Consider treating access via token as equivalent to reporter access for the purpose of internal-note filtering:
🛡️ Suggested adjustment
- boolean isReporter = user != null && user.getRole() == Role.REPORTER;
- boolean isAnonymous = user == null;
+ boolean hasValidToken = token != null && token.equals(ticket.getReporterToken());
+ boolean isReporter = user != null && user.getRole() == Role.REPORTER;
+ boolean isAnonymous = user == null;
+ boolean isPrivilegedViewer = user != null
+ && (user.getRole() == Role.ADMIN
+ || (user.getRole() == Role.INVESTIGATOR
+ && ticket.getInvestigator() != null
+ && ticket.getInvestigator().getId().equals(user.getId())));
- List<TicketComment> all = (isReporter || isAnonymous)
+ List<TicketComment> all = (isReporter || isAnonymous || (hasValidToken && !isPrivilegedViewer))
? ticketCommentRepository.findByTicketIdAndInternalNoteFalseOrderByCreatedAtAsc(ticketId)
: ticketCommentRepository.findByTicketIdOrderByCreatedAtAsc(ticketId);
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@src/main/java/org/example/alfs/services/TicketCommentService.java` around
lines 75 - 99, The checkAccess logic currently authorizes authenticated users
before the reporter-token branch, which allows an authenticated non-reporter
(e.g., INVESTIGATOR) who also has the reporter token to be granted access but
not flagged as a reporter in getComments (so internalNote filtering is skipped).
Fix by treating token-based access as equivalent to reporter access: either move
the token check in checkAccess to run before role checks or add explicit logic
in checkAccess that, when token.equals(ticket.getReporterToken()), returns
access and ensures callers (getComments) can detect reporter access (e.g., set
isReporter true when token matched); update getComments to compute isReporter
using token match (ticket.getReporterToken()) in addition to user role checks.
Originally posted by @coderabbitai[bot] in #26 (comment)
Token-based access should be evaluated before user role, or treated equivalently to reporter.
The
checkAccesslogic authorizes authenticated users first and falls through to the token check. Combined withgetComments(Lines 62–67), this creates a subtle information-disclosure gap:An authenticated
INVESTIGATOR(or any non-admin authenticated user) who is not assigned to this ticket but possesses the reporter token will be authorized via the token branch. IngetComments,isReporterisfalseandisAnonymousisfalse, so they receive all comments includinginternalNote=trueentries — which a bona-fide reporter using the same token would be filtered away from.Consider treating access via token as equivalent to reporter access for the purpose of internal-note filtering:
🛡️ Suggested adjustment
🤖 Prompt for AI Agents
Originally posted by @coderabbitai[bot] in #26 (comment)