Repository navigation
feat(api,web): enforce 403 on unauthorized reads and close error-code gaps - #32
Merged
Merged
Conversation
… gaps Unauthorized access to an existing private record now returns 403 Forbidden with a specific domain code instead of being hidden behind a 404. The 404 remains for records that genuinely do not exist. Backend: - register the missing domain codes in @researchos/error-codes and raise them as typed CodedHttpException instances - replace the remaining prose exceptions with machine-readable codes so the frontend never receives English sentences - background jobs: distinguish a missing job (404) from one the caller may not access (403), keeping admin access to research-update jobs Frontend: - add English and Vietnamese translations for every new domain code - the catalog spec keeps both locales and the registry in step Verified: api 448 tests, web 85 tests, error-codes 6 tests, lint clean. Co-authored-by: Cursor <cursoragent@cursor.com>
The e2e suite still asserted the old behaviour, where a job owned by another caller was reported as missing (404). The job does exist, so the callers without access are now denied with 403 and 404 is reserved for a job that does not exist. The owner, the non-owner admin and the non-admin are all denied on the same existing job, so the three assertions move from 404 to 403. The owner retry still conflicts (409) because the job is not failed. Co-authored-by: Cursor <cursoragent@cursor.com>
The enum carried three values but only one of them described authority. CORE_MEMBER was the value the policy read to decide who may manage a group's membership; COLLABORATOR and STUDENT_MEMBER were labels that granted nothing and were never read by a policy. The type now says what the role does. MEMBER is a group member without management rights and GROUP_LEADER is the member who may manage the membership. The group's own leader is still research_groups.lead_id, so a GROUP_LEADER membership row is the delegated equivalent and both are accepted by the same rule. - ResearchOS.dbml is the schema source; ResearchOS.sql is regenerated from it with the official exporter and the datamodel in schema.prisma follows, so the drift check stays green - migration rebuilds the type: Postgres cannot rename or drop a value that is still in use, so the rows are cast through text onto the new type, with CORE_MEMBER becoming GROUP_LEADER and the rest MEMBER - can_manage_opportunity names the new value - the API, the seed script and the generated OpenAPI client follow Co-authored-by: Cursor <cursoragent@cursor.com>
Prettier reformats the it.each table after the duplicate non-manager case was dropped. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Unauthorized access to an existing private record now returns 403 Forbidden with a specific domain code, instead of being hidden behind a 404. The 404 remains for records that genuinely do not exist.
Backend
@researchos/error-codesand raise them as typedCodedHttpExceptioninstances.Frontend
Verification
api: 448 tests passedweb: 85 tests passed@researchos/error-codes: 6 tests passedlint: 0 errorsopenapi:check: document up to date