Check APIs Access

[Rodina222]

• check every endpoint access for (get, list, update delete actions)

Project:

• anyone member can (get, list)
• the owner of the project or any admin of it can (update, delete)

Component:

• any member can (get, list)
• the creator of the component or any admin of the project can (update, delete)

Bug:

• any member can (get, list)
• the creator of the bug or any admin of the project can (update, delete)

Comment:

• any member can (get, list)
• the creator of the comment (update, delete)

[AbdelrahmanElawady]

can you please add more description on what are you handling and what is the bug exactly? :)

[rawdaGastan]

@AbdelrahmanElawady updated

[AbdelrahmanElawady]

should the admin and component creator be able to delete a comment?

[Omar622]

• jwt secret key haven't been added to the code (need to be used from config file)

• /user PUT - update user endpoint, is allowing just updating user's name

• /user GET + authorization - get my data as a user endpoint, returns all user data including hashed password and verification code and verification code timeout and some fields written as camel case

  • response sample: { "msg": "user is found", "data": { "ID": "de4d9834-c146-4d50-b92c-5fd0caa6071b", "name": "omar abdelghani", "email": "omar@gmail.com", "password": "�?��Us6�\b��7��
�e|.�E$1X�������J��r���q��&", "VerificationCode": 773908, "Verified": true, "VerificationCodeTimeout": "2023-08-28T20:13:06.051860404+03:00" } }

• if i made request with no token the response is (i guess there's a return missed somewhere in code): { "err": "token not found" }{ "err": "token is invalid" }

• also in the same endpoint it always returns the first user in the db no matter the sent token (GetUserByID this method on db doesn't use id)

• when i create project then delete it then create new one i got error "err": "member already exists" (when project is deleted, no delete cascaded into members table)

• when i transfer project ownership, nothing happens in members table (the new owner is not added to members table and the previous owner is still owner in members table)

• /member/:id PUT - update member ownership, always returns "err": "record not found" (i guess UpdateMemberOwnership on db doesn't work correctly)

• /member POST - add member, id in the response is always equal to 0

• /project/:id DELETE - delete project, owner only can delete project (admin is not handled)

• component, bug and comment endpoints haven't been reviewed yet.

[AbdelrahmanElawady]

@Omar622 these are very nice findings. However, I don't think all these bugs are related to this issue. It would be great if you break down all these bugs into smaller issues for easier tracking and leave the ones related to this issue here. Thanks :)