permissions for ProjectByCode endpoint

sillsdev · Jul 7, 2023 · e24d1fa · e24d1fa
1 parent 5366f92
commit e24d1fa
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/backend/LexBoxApi/GraphQL/LexQueries.cs b/backend/LexBoxApi/GraphQL/LexQueries.cs
@@ -30,8 +30,9 @@ public IQueryable<Project> Projects(LexBoxDbContext context)
 
     [UseSingleOrDefault]
     [UseProjection]
-    public IQueryable<Project> ProjectByCode(LexBoxDbContext context, string code)
+    public IQueryable<Project> ProjectByCode(LexBoxDbContext context, LoggedInContext loggedInContext, string code)
     {
+        loggedInContext.User.AssertCanAccessProject(code);
         return context.Projects.Where(p => p.Code == code);
     }
 

diff --git a/backend/LexCore/Auth/LexAuthUser.cs b/backend/LexCore/Auth/LexAuthUser.cs
@@ -132,6 +132,11 @@ public void AssertCanManageProject(Guid projectId)
     {
         if (!CanManageProject(projectId)) throw new UnauthorizedAccessException();
     }
+
+    public void AssertCanAccessProject(string projectCode)
+    {
+        if (Role != UserRole.admin && Projects.All(p => p.Code != projectCode)) throw new UnauthorizedAccessException();
+    }
 }
 
 public record AuthUserProject(string Code, ProjectRole Role, Guid ProjectId);