Adds access control check for reminders

system/service/reminder.go

@@ -87,6 +87,10 @@ func (svc reminder) FindByID(ctx context.Context, ID uint64) (r *types.Reminder,
 			return err
 		}
 
+		if svc.checkAssignTo(ctx, r) {
+			return ReminderErrNotAllowedToRead()
+		}
+
 		raProps.setReminder(r)
 
 		return nil
@@ -100,14 +104,14 @@ func (svc reminder) FindByIDs(ctx context.Context, IDs ...uint64) (rr types.Remi
 		return nil, nil
 	}
 
-	rr, _, err = svc.Find(ctx, types.ReminderFilter{ReminderID: IDs})
+	rr, _, err = svc.Find(ctx, types.ReminderFilter{ReminderID: IDs, AssignedTo: svc.currentUser(ctx)})
 
 	return rr, nil
 }
 
 func (svc reminder) checkAssignee(ctx context.Context, rm *types.Reminder) (err error) {
 	// Check if user is assigning to someone else
-	if rm.AssignedTo != svc.currentUser(ctx) {
+	if svc.checkAssignTo(ctx, rm) {
 		if !svc.ac.CanAssignReminder(ctx) {
 			return ReminderErrNotAllowedToAssign()
 		}
@@ -116,6 +120,11 @@ func (svc reminder) checkAssignee(ctx context.Context, rm *types.Reminder) (err
 	return nil
 }
 
+// checkAssignTo compares current user with reminder.AssignedTo and return bool
+func (svc reminder) checkAssignTo(ctx context.Context, rm *types.Reminder) (valid bool) {
+	return rm.AssignedTo != svc.currentUser(ctx)
+}
+
 func (svc reminder) currentUser(ctx context.Context) uint64 {
 	return intAuth.GetIdentityFromContext(ctx).Identity()
 }
@@ -201,6 +210,10 @@ func (svc reminder) Dismiss(ctx context.Context, ID uint64) (err error) {
 			return ReminderErrNotFound()
 		}
 
+		if svc.checkAssignTo(ctx, r) {
+			return ReminderErrNotAllowedToDismiss()
+		}
+
 		raProps.setReminder(r)
 
 		// Assign changed values

system/service/reminder_actions.gen.go

@@ -550,6 +550,66 @@ func ReminderErrNotAllowedToAssign(mm ...*reminderActionProps) *errors.Error {
 	return e
 }
 
+// ReminderErrNotAllowedToDismiss returns "system:reminder.notAllowedToDismiss" as *errors.Error
+//
+//
+// This function is auto-generated.
+//
+func ReminderErrNotAllowedToDismiss(mm ...*reminderActionProps) *errors.Error {
+	var p = &reminderActionProps{}
+	if len(mm) > 0 {
+		p = mm[0]
+	}
+
+	var e = errors.New(
+		errors.KindInternal,
+
+		p.Format("not allowed to dismiss reminders of other users", nil),
+
+		errors.Meta("type", "notAllowedToDismiss"),
+		errors.Meta("resource", "system:reminder"),
+
+		errors.Meta(reminderPropsMetaKey{}, p),
+
+		errors.StackSkip(1),
+	)
+
+	if len(mm) > 0 {
+	}
+
+	return e
+}
+
+// ReminderErrNotAllowedToRead returns "system:reminder.notAllowedToRead" as *errors.Error
+//
+//
+// This function is auto-generated.
+//
+func ReminderErrNotAllowedToRead(mm ...*reminderActionProps) *errors.Error {
+	var p = &reminderActionProps{}
+	if len(mm) > 0 {
+		p = mm[0]
+	}
+
+	var e = errors.New(
+		errors.KindInternal,
+
+		p.Format("not allowed to read reminders of other users", nil),
+
+		errors.Meta("type", "notAllowedToRead"),
+		errors.Meta("resource", "system:reminder"),
+
+		errors.Meta(reminderPropsMetaKey{}, p),
+
+		errors.StackSkip(1),
+	)
+
+	if len(mm) > 0 {
+	}
+
+	return e
+}
+
 // *********************************************************************************************************************
 // *********************************************************************************************************************
 

system/service/reminder_actions.yaml

@@ -61,3 +61,9 @@ errors:
 
   - error: notAllowedToAssign
     message: "not allowed to assign reminders to other users"
+
+  - error: notAllowedToDismiss
+    message: "not allowed to dismiss reminders of other users"
+
+  - error: notAllowedToRead
+    message: "not allowed to read reminders of other users"

tests/system/reminder_test.go

@@ -21,7 +21,11 @@ func (h helper) clearReminders() {
 }
 
 func (h helper) makeReminder() *types.Reminder {
-	rm := &types.Reminder{Resource: "test:resource", AssignedTo: h.cUser.ID}
+	return h.makeReminderByUserID(h.cUser.ID)
+}
+
+func (h helper) makeReminderByUserID(userID uint64) *types.Reminder {
+	rm := &types.Reminder{Resource: "test:resource", AssignedTo: userID}
 	rm.ID = id.Next()
 	rm.CreatedAt = time.Now()
 	h.noError(store.CreateReminder(context.Background(), service.DefaultStore, rm))
@@ -98,6 +102,22 @@ func TestReminderRead(t *testing.T) {
 		End()
 }
 
+// TestReminderReadForbidden checks only user themself can read reminder assigned to them
+func TestReminderReadForbidden(t *testing.T) {
+	h := newHelper(t)
+	h.clearReminders()
+
+	rm := h.makeReminderByUserID(id.Next())
+
+	h.apiInit().
+		Get(fmt.Sprintf("/reminder/%d", rm.ID)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("not allowed to read reminders of other users")).
+		End()
+}
+
 func TestReminderList(t *testing.T) {
 	h := newHelper(t)
 	h.clearReminders()
@@ -179,6 +199,22 @@ func TestReminderDismiss(t *testing.T) {
 		End()
 }
 
+// TestReminderDismissForbidden checks only user themself can dismiss reminder assigned to them
+func TestReminderDismissForbidden(t *testing.T) {
+	h := newHelper(t)
+	h.clearReminders()
+
+	rm := h.makeReminderByUserID(id.Next())
+
+	h.apiInit().
+		Patch(fmt.Sprintf("/reminder/%d/dismiss", rm.ID)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("not allowed to dismiss reminders of other users")).
+		End()
+}
+
 func TestReminderSnooze(t *testing.T) {
 	h := newHelper(t)
 	h.clearReminders()