fix: add missing route guards to issues pages (#2235)

* fix: users should always be able to view their own issues

* fix: apply route guards to issues pages instead

* fix(api): only allow users w/ issue perms to edit comments / delete issues

server/routes/issue.ts

@@ -68,7 +68,7 @@ issueRoutes.get<Record<string, string>, IssueResultsResponse>(
         return next({
           status: 403,
           message:
-            'You do not have permission to view issues created by other users',
+            'You do not have permission to view issues reported by other users',
         });
       }
       query = query.andWhere('createdBy.id = :id', { id: req.user?.id });
@@ -291,7 +291,12 @@ issueRoutes.post<{ issueId: string; status: string }, Issue>(
   }
 );
 
-issueRoutes.delete('/:issueId', async (req, res, next) => {
+issueRoutes.delete(
+  '/:issueId',
+  isAuthenticated([Permission.MANAGE_ISSUES, Permission.CREATE_ISSUES], {
+    type: 'or',
+  }),
+  async (req, res, next) => {
     const issueRepository = getRepository(Issue);
 
     try {
@@ -320,6 +325,7 @@ issueRoutes.delete('/:issueId', async (req, res, next) => {
       });
       next({ status: 404, message: 'Issue not found.' });
     }
-});
+  }
+);
 
 export default issueRoutes;

server/routes/request.ts

@@ -500,9 +500,26 @@ requestRoutes.get('/:requestId', async (req, res, next) => {
       relations: ['requestedBy', 'modifiedBy'],
     });
 
+    if (
+      request.requestedBy.id !== req.user?.id &&
+      !req.user?.hasPermission(
+        [Permission.MANAGE_REQUESTS, Permission.REQUEST_VIEW],
+        { type: 'or' }
+      )
+    ) {
+      return next({
+        status: 403,
+        message: 'You do not have permission to view this request.',
+      });
+    }
+
     return res.status(200).json(request);
   } catch (e) {
-    next({ status: 404, message: 'Request not found' });
+    logger.debug('Failed to retrieve request.', {
+      label: 'API',
+      errorMessage: e.message,
+    });
+    next({ status: 404, message: 'Request not found.' });
   }
 });
 

src/pages/issues/[issueId]/index.tsx

@@ -1,8 +1,20 @@
 import { NextPage } from 'next';
 import React from 'react';
 import IssueDetails from '../../../components/IssueDetails';
+import useRouteGuard from '../../../hooks/useRouteGuard';
+import { Permission } from '../../../hooks/useUser';
 
 const IssuePage: NextPage = () => {
+  useRouteGuard(
+    [
+      Permission.MANAGE_ISSUES,
+      Permission.CREATE_ISSUES,
+      Permission.VIEW_ISSUES,
+    ],
+    {
+      type: 'or',
+    }
+  );
   return <IssueDetails />;
 };
 

src/pages/issues/index.tsx

@@ -1,8 +1,20 @@
 import { NextPage } from 'next';
 import React from 'react';
 import IssueList from '../../components/IssueList';
+import useRouteGuard from '../../hooks/useRouteGuard';
+import { Permission } from '../../hooks/useUser';
 
 const IssuePage: NextPage = () => {
+  useRouteGuard(
+    [
+      Permission.MANAGE_ISSUES,
+      Permission.CREATE_ISSUES,
+      Permission.VIEW_ISSUES,
+    ],
+    {
+      type: 'or',
+    }
+  );
   return <IssueList />;
 };