chore!: Improve permissions check on roles endpoints (#32347)

RocketChat · Jun 19, 2024 · dfaabe5 · dfaabe5
1 parent e3ee977
commit dfaabe5
Show file tree

Hide file tree

Showing 2 changed files with 419 additions and 14 deletions.
diff --git a/apps/meteor/app/api/server/v1/roles.ts b/apps/meteor/app/api/server/v1/roles.ts
@@ -91,7 +91,7 @@ API.v1.addRoute(
 
 API.v1.addRoute(
 	'roles.getUsersInRole',
-	{ authRequired: true },
+	{ authRequired: true, permissionsRequired: ['access-permissions'] },
 	{
 		async get() {
 			const { roomId, role } = this.queryParams;
@@ -109,9 +109,6 @@ API.v1.addRoute(
 			if (!role) {
 				throw new Meteor.Error('error-param-not-provided', 'Query param "role" is required');
 			}
-			if (!(await hasPermissionAsync(this.userId, 'access-permissions'))) {
-				throw new Meteor.Error('error-not-allowed', 'Not allowed');
-			}
 			if (roomId && !(await hasPermissionAsync(this.userId, 'view-other-user-channels'))) {
 				throw new Meteor.Error('error-not-allowed', 'Not allowed');
 			}
@@ -150,18 +147,14 @@ API.v1.addRoute(
 
 API.v1.addRoute(
 	'roles.delete',
-	{ authRequired: true },
+	{ authRequired: true, permissionsRequired: ['access-permissions'] },
 	{
 		async post() {
 			const { bodyParams } = this;
 			if (!isRoleDeleteProps(bodyParams)) {
 				throw new Meteor.Error('error-invalid-role-properties', 'The role properties are invalid.');
 			}
 
-			if (!(await hasPermissionAsync(this.userId, 'access-permissions'))) {
-				throw new Meteor.Error('error-action-not-allowed', 'Accessing permissions is not allowed');
-			}
-
 			const role = await Roles.findOneByIdOrName(bodyParams.roleId);
 
 			if (!role) {
@@ -189,7 +182,7 @@ API.v1.addRoute(
 
 API.v1.addRoute(
 	'roles.removeUserFromRole',
-	{ authRequired: true },
+	{ authRequired: true, permissionsRequired: ['access-permissions'] },
 	{
 		async post() {
 			const { bodyParams } = this;
@@ -199,10 +192,6 @@ API.v1.addRoute(
 
 			const { roleId, roleName, username, scope } = bodyParams;
 
-			if (!(await hasPermissionAsync(this.userId, 'access-permissions'))) {
-				throw new Meteor.Error('error-not-allowed', 'Accessing permissions is not allowed');
-			}
-
 			if (!roleId) {
 				if (!roleName) {
 					return API.v1.failure('error-invalid-role-properties');