Skip to content

Commit

Permalink
chore: add access control to appflowy web related endpoint (#896)
Browse files Browse the repository at this point in the history
  • Loading branch information
khorshuheng authored Oct 17, 2024
1 parent ee0831e commit 7d6d1fd
Showing 1 changed file with 15 additions and 0 deletions.
15 changes: 15 additions & 0 deletions src/api/workspace.rs
Original file line number Diff line number Diff line change
Expand Up @@ -880,6 +880,14 @@ async fn get_page_view_handler(
.get_user_uid(&user_uuid)
.await
.map_err(AppResponseError::from)?;
let has_access = state
.workspace_access_control
.enforce_action(&uid, &workspace_uuid.to_string(), Action::Read)
.await?;
if !has_access {
return Err(AppError::NotEnoughPermissions.into());
}

let page_collab = get_page_view_collab(
&state.pg_pool,
state.collab_access_control_storage.clone(),
Expand Down Expand Up @@ -1457,6 +1465,13 @@ async fn get_workspace_folder_handler(
let depth = query.depth.unwrap_or(1);
let uid = state.user_cache.get_user_uid(&user_uuid).await?;
let workspace_id = workspace_id.into_inner();
let has_access = state
.workspace_access_control
.enforce_action(&uid, &workspace_id.to_string(), Action::Read)
.await?;
if !has_access {
return Err(AppError::NotEnoughPermissions.into());
}
let root_view_id = if let Some(root_view_id) = query.root_view_id.as_ref() {
root_view_id.to_string()
} else {
Expand Down

0 comments on commit 7d6d1fd

Please sign in to comment.