chk
/
AppFlowy-Cloud
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

chore: add access control to appflowy web related endpoint (#896)

This commit is contained in:
Khor Shu Heng 2024-10-17 17:03:12 +08:00 committed by GitHub
parent ee0831e223
commit 7d6d1fd151
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/api/workspace.rs
View File

@ -880,6 +880,14 @@ async fn get_page_view_handler(
.get_user_uid(&user_uuid)
.await
.map_err(AppResponseError::from)?;
let has_access = state
.workspace_access_control
.enforce_action(&uid, &workspace_uuid.to_string(), Action::Read)
.await?;
if !has_access {
return Err(AppError::NotEnoughPermissions.into());
}
let page_collab = get_page_view_collab(
&state.pg_pool,
state.collab_access_control_storage.clone(),
@ -1457,6 +1465,13 @@ async fn get_workspace_folder_handler(
let depth = query.depth.unwrap_or(1);
let uid = state.user_cache.get_user_uid(&user_uuid).await?;
let workspace_id = workspace_id.into_inner();
let has_access = state
.workspace_access_control
.enforce_action(&uid, &workspace_id.to_string(), Action::Read)
.await?;
if !has_access {
return Err(AppError::NotEnoughPermissions.into());
}
let root_view_id = if let Some(root_view_id) = query.root_view_id.as_ref() {
root_view_id.to_string()
} else {