ami/tl-vikunja
1
0
Fork 0
Code

fix(api): make sure permission to read all tasks work for reading all tasks per project

Browse Source 
Resolves https://github.com/go-vikunja/api/issues/105
This commit is contained in:
kolaente 2024-01-14 22:17:22 +01:00
parent 09696aec1b
commit 514ea71d93
No known key found for this signature in database
GPG Key ID: F40E70337AB24C9B
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
pkg/models/api_routes.go
View File

@ -17,6 +17,7 @@
package models package models
import ( import (
"code.vikunja.io/api/pkg/log"
"net/http" "net/http"
"strings" "strings"
@ -166,12 +167,19 @@ func CanDoAPIRoute(c echo.Context, token *APIToken) (can bool) {
route = "delete" route = "delete"
} }
// The tasks read_all route is available as /:project/tasks and /tasks/all - therefore we need this workaround here.
if routeGroupName == "tasks" && path == "/api/v1/projects/:project/tasks" && c.Request().Method == http.MethodGet {
route = "read_all"
}
for _, p := range group { for _, p := range group {
if p == route { if p == route {
return true return true
} }
} }
log.Debugf("[auth] Token %d tried to use route %s which requires permission %s but has only %v", token.ID, path, route, token.Permissions)
return false return false
} }

2
pkg/routes/api_tokens.go
View File

@ -23,6 +23,7 @@ import (
"code.vikunja.io/api/pkg/config" "code.vikunja.io/api/pkg/config"
"code.vikunja.io/api/pkg/db" "code.vikunja.io/api/pkg/db"
"code.vikunja.io/api/pkg/log"
"code.vikunja.io/api/pkg/models" "code.vikunja.io/api/pkg/models"
echojwt "github.com/labstack/echo-jwt/v4" echojwt "github.com/labstack/echo-jwt/v4"
@ -66,6 +67,7 @@ func checkAPITokenAndPutItInContext(tokenHeaderValue string, c echo.Context) err
} }
if time.Now().After(token.ExpiresAt) { if time.Now().After(token.ExpiresAt) {
log.Debugf("[auth] Tried authenticating with token %d but it expired on %s", token.ID, token.ExpiresAt.String())
return echo.NewHTTPError(http.StatusUnauthorized) return echo.NewHTTPError(http.StatusUnauthorized)
} }