calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-08-07 04:58:44 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix non admins cant see private resources details in launcher

Browse Source
This commit is contained in:
miloschwartz
2026-08-06 12:32:19 -04:00
parent 82b86263dc
commit 4048fa274a
7 changed files with 180 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/routers/siteResource/listAllSiteResourcesByOrg.ts
+45 -2
View File
@@ -3,11 +3,13 @@ import {
DB_TYPE,
Label,
SiteResource,
roleSiteResources,
siteNetworks,
siteResourceLabels,
siteResources,
sites,
labels
labels,
userSiteResources
} from "@server/db";
import response from "@server/lib/response";
import logger from "@server/logger";
@@ -323,7 +325,48 @@ export async function listAllSiteResourcesByOrg(
labels: labelFilter
} = parsedQuery.data;
const conditions = [and(eq(siteResources.orgId, orgId))];
let accessibleSiteResourceIds: number[];
if (req.user) {
const accessibleSiteResources = await db
.select({
siteResourceId: sql<number>`COALESCE(${userSiteResources.siteResourceId}, ${roleSiteResources.siteResourceId})`
})
.from(userSiteResources)
.fullJoin(
roleSiteResources,
eq(
userSiteResources.siteResourceId,
roleSiteResources.siteResourceId
)
)
.where(
or(
eq(userSiteResources.userId, req.user.userId),
inArray(
roleSiteResources.roleId,
req.userOrgRoleIds ?? []
)
)
);
accessibleSiteResourceIds = accessibleSiteResources.map(
(row) => row.siteResourceId
);
} else {
const allOrgSiteResources = await db
.select({ siteResourceId: siteResources.siteResourceId })
.from(siteResources)
.where(eq(siteResources.orgId, orgId));
accessibleSiteResourceIds = allOrgSiteResources.map(
(row) => row.siteResourceId
);
}
const conditions = [
and(
eq(siteResources.orgId, orgId),
inArray(siteResources.siteResourceId, accessibleSiteResourceIds)
)
];
if (siteId != null) {
// Keep inner joins here: filtering by a specific site implies the
server/routers/siteResource/listSiteResources.ts
+46 -3
View File
@@ -1,11 +1,17 @@
import { Request, Response, NextFunction } from "express";
import { z } from "zod";
import { db, networks, siteNetworks } from "@server/db";
import {
db,
networks,
roleSiteResources,
siteNetworks,
userSiteResources
} from "@server/db";
import { siteResources, sites, SiteResource } from "@server/db";
import response from "@server/lib/response";
import HttpCode from "@server/types/HttpCode";
import createHttpError from "http-errors";
import { and, asc, desc, eq } from "drizzle-orm";
import { and, asc, desc, eq, inArray, or, sql } from "drizzle-orm";
import { fromError } from "zod-validation-error";
import logger from "@server/logger";
import { OpenAPITags, registry } from "@server/openApi";
@@ -159,10 +165,47 @@ export async function listSiteResources(
return next(createHttpError(HttpCode.NOT_FOUND, "Site not found"));
}
let accessibleSiteResourceIds: number[];
if (req.user) {
const accessibleSiteResources = await db
.select({
siteResourceId: sql<number>`COALESCE(${userSiteResources.siteResourceId}, ${roleSiteResources.siteResourceId})`
})
.from(userSiteResources)
.fullJoin(
roleSiteResources,
eq(
userSiteResources.siteResourceId,
roleSiteResources.siteResourceId
)
)
.where(
or(
eq(userSiteResources.userId, req.user.userId),
inArray(
roleSiteResources.roleId,
req.userOrgRoleIds ?? []
)
)
);
accessibleSiteResourceIds = accessibleSiteResources.map(
(row) => row.siteResourceId
);
} else {
const allOrgSiteResources = await db
.select({ siteResourceId: siteResources.siteResourceId })
.from(siteResources)
.where(eq(siteResources.orgId, orgId));
accessibleSiteResourceIds = allOrgSiteResources.map(
(row) => row.siteResourceId
);
}
// Get site resources by joining networks to siteResources via siteNetworks
const conditions = [
eq(siteNetworks.siteId, siteId),
eq(siteResources.orgId, orgId)
eq(siteResources.orgId, orgId),
inArray(siteResources.siteResourceId, accessibleSiteResourceIds)
];
if (typeof status !== "undefined") {