2sys/phonograph
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix auth for update_field_handler

Browse source
This commit is contained in:
Brent Schroeter 2025-12-11 08:34:32 +00:00
parent 92d2a963f5
commit 1086e95036
1 changed files with 29 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
phono-server/src/routes/relations_single/update_field_handler.rs
View file

@ -1,5 +1,13 @@
use axum::{debug_handler, extract::Path, response::Response}; use axum::{
use phono_models::{field::Field, presentation::Presentation}; debug_handler,
extract::{Path, State},
response::Response,
};
use phono_models::{
accessors::{Accessor, Actor, portal::PortalAccessor},
field::Field,
presentation::Presentation,
};
use serde::Deserialize; use serde::Deserialize;
use sqlx::postgres::types::Oid; use sqlx::postgres::types::Oid;
use uuid::Uuid; use uuid::Uuid;
@ -12,6 +20,7 @@ use crate::{
navigator::{Navigator, NavigatorPage}, navigator::{Navigator, NavigatorPage},
presentation_form::PresentationForm, presentation_form::PresentationForm,
user::CurrentUser, user::CurrentUser,
workspace_pooler::WorkspacePooler,
}; };
#[derive(Debug, Deserialize)] #[derive(Debug, Deserialize)]
@ -59,8 +68,9 @@ impl From<FormBody> for PresentationForm {
/// [`PathParams`]. /// [`PathParams`].
#[debug_handler(state = App)] #[debug_handler(state = App)]
pub(super) async fn post( pub(super) async fn post(
State(mut pooler): State<WorkspacePooler>,
AppDbConn(mut app_db): AppDbConn, AppDbConn(mut app_db): AppDbConn,
CurrentUser(_user): CurrentUser, CurrentUser(user): CurrentUser,
navigator: Navigator, navigator: Navigator,
Path(PathParams { Path(PathParams {
portal_id, portal_id,
@ -71,8 +81,22 @@ pub(super) async fn post(
) -> Result<Response, AppError> { ) -> Result<Response, AppError> {
// FIXME CSRF // FIXME CSRF
// FIXME ensure workspace corresponds to rel/portal, and that user has let mut workspace_client = pooler
// permission to access/alter both as needed. .acquire_for(
workspace_id,
crate::workspace_pooler::RoleAssignment::User(user.id),
)
.await?;
PortalAccessor::new()
.id(portal_id)
.as_actor(Actor::User(user.id))
.verify_rel_oid(Oid(rel_oid))
.verify_workspace_id(workspace_id)
.verify_rel_ownership()
.using_workspace_client(&mut workspace_client)
.using_app_db(&mut app_db)
.fetch_one()
.await?;
// Ensure field exists and belongs to portal. // Ensure field exists and belongs to portal.
Field::belonging_to_portal(portal_id) Field::belonging_to_portal(portal_id)