diff --git a/system/service/reminder.go b/system/service/reminder.go index 5b975f382..027ada0eb 100644 --- a/system/service/reminder.go +++ b/system/service/reminder.go @@ -87,6 +87,10 @@ func (svc reminder) FindByID(ctx context.Context, ID uint64) (r *types.Reminder, return err } + if svc.checkAssignTo(ctx, r) { + return ReminderErrNotAllowedToRead() + } + raProps.setReminder(r) return nil @@ -100,14 +104,14 @@ func (svc reminder) FindByIDs(ctx context.Context, IDs ...uint64) (rr types.Remi return nil, nil } - rr, _, err = svc.Find(ctx, types.ReminderFilter{ReminderID: IDs}) + rr, _, err = svc.Find(ctx, types.ReminderFilter{ReminderID: IDs, AssignedTo: svc.currentUser(ctx)}) return rr, nil } func (svc reminder) checkAssignee(ctx context.Context, rm *types.Reminder) (err error) { // Check if user is assigning to someone else - if rm.AssignedTo != svc.currentUser(ctx) { + if svc.checkAssignTo(ctx, rm) { if !svc.ac.CanAssignReminder(ctx) { return ReminderErrNotAllowedToAssign() } @@ -116,6 +120,11 @@ func (svc reminder) checkAssignee(ctx context.Context, rm *types.Reminder) (err return nil } +// checkAssignTo compares current user with reminder.AssignedTo and return bool +func (svc reminder) checkAssignTo(ctx context.Context, rm *types.Reminder) (valid bool) { + return rm.AssignedTo != svc.currentUser(ctx) +} + func (svc reminder) currentUser(ctx context.Context) uint64 { return intAuth.GetIdentityFromContext(ctx).Identity() } @@ -201,6 +210,10 @@ func (svc reminder) Dismiss(ctx context.Context, ID uint64) (err error) { return ReminderErrNotFound() } + if svc.checkAssignTo(ctx, r) { + return ReminderErrNotAllowedToDismiss() + } + raProps.setReminder(r) // Assign changed values diff --git a/system/service/reminder_actions.gen.go b/system/service/reminder_actions.gen.go index a97c3cdeb..798746ac3 100644 --- a/system/service/reminder_actions.gen.go +++ b/system/service/reminder_actions.gen.go @@ -550,6 +550,66 @@ func ReminderErrNotAllowedToAssign(mm ...*reminderActionProps) *errors.Error { return e } +// ReminderErrNotAllowedToDismiss returns "system:reminder.notAllowedToDismiss" as *errors.Error +// +// +// This function is auto-generated. +// +func ReminderErrNotAllowedToDismiss(mm ...*reminderActionProps) *errors.Error { + var p = &reminderActionProps{} + if len(mm) > 0 { + p = mm[0] + } + + var e = errors.New( + errors.KindInternal, + + p.Format("not allowed to dismiss reminders of other users", nil), + + errors.Meta("type", "notAllowedToDismiss"), + errors.Meta("resource", "system:reminder"), + + errors.Meta(reminderPropsMetaKey{}, p), + + errors.StackSkip(1), + ) + + if len(mm) > 0 { + } + + return e +} + +// ReminderErrNotAllowedToRead returns "system:reminder.notAllowedToRead" as *errors.Error +// +// +// This function is auto-generated. +// +func ReminderErrNotAllowedToRead(mm ...*reminderActionProps) *errors.Error { + var p = &reminderActionProps{} + if len(mm) > 0 { + p = mm[0] + } + + var e = errors.New( + errors.KindInternal, + + p.Format("not allowed to read reminders of other users", nil), + + errors.Meta("type", "notAllowedToRead"), + errors.Meta("resource", "system:reminder"), + + errors.Meta(reminderPropsMetaKey{}, p), + + errors.StackSkip(1), + ) + + if len(mm) > 0 { + } + + return e +} + // ********************************************************************************************************************* // ********************************************************************************************************************* diff --git a/system/service/reminder_actions.yaml b/system/service/reminder_actions.yaml index 6b9646abd..baedfb887 100644 --- a/system/service/reminder_actions.yaml +++ b/system/service/reminder_actions.yaml @@ -61,3 +61,9 @@ errors: - error: notAllowedToAssign message: "not allowed to assign reminders to other users" + + - error: notAllowedToDismiss + message: "not allowed to dismiss reminders of other users" + + - error: notAllowedToRead + message: "not allowed to read reminders of other users" diff --git a/tests/system/reminder_test.go b/tests/system/reminder_test.go index 25633cd34..106b76ce7 100644 --- a/tests/system/reminder_test.go +++ b/tests/system/reminder_test.go @@ -21,7 +21,11 @@ func (h helper) clearReminders() { } func (h helper) makeReminder() *types.Reminder { - rm := &types.Reminder{Resource: "test:resource", AssignedTo: h.cUser.ID} + return h.makeReminderByUserID(h.cUser.ID) +} + +func (h helper) makeReminderByUserID(userID uint64) *types.Reminder { + rm := &types.Reminder{Resource: "test:resource", AssignedTo: userID} rm.ID = id.Next() rm.CreatedAt = time.Now() h.noError(store.CreateReminder(context.Background(), service.DefaultStore, rm)) @@ -98,6 +102,22 @@ func TestReminderRead(t *testing.T) { End() } +// TestReminderReadForbidden checks only user themself can read reminder assigned to them +func TestReminderReadForbidden(t *testing.T) { + h := newHelper(t) + h.clearReminders() + + rm := h.makeReminderByUserID(id.Next()) + + h.apiInit(). + Get(fmt.Sprintf("/reminder/%d", rm.ID)). + Header("Accept", "application/json"). + Expect(t). + Status(http.StatusOK). + Assert(helpers.AssertError("not allowed to read reminders of other users")). + End() +} + func TestReminderList(t *testing.T) { h := newHelper(t) h.clearReminders() @@ -179,6 +199,22 @@ func TestReminderDismiss(t *testing.T) { End() } +// TestReminderDismissForbidden checks only user themself can dismiss reminder assigned to them +func TestReminderDismissForbidden(t *testing.T) { + h := newHelper(t) + h.clearReminders() + + rm := h.makeReminderByUserID(id.Next()) + + h.apiInit(). + Patch(fmt.Sprintf("/reminder/%d/dismiss", rm.ID)). + Header("Accept", "application/json"). + Expect(t). + Status(http.StatusOK). + Assert(helpers.AssertError("not allowed to dismiss reminders of other users")). + End() +} + func TestReminderSnooze(t *testing.T) { h := newHelper(t) h.clearReminders()