test(review): verify T0 revision-aware production flow #393
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,11 @@ | ||||||||||||||||||||
| export type WorkspaceRole = "owner" | "member"; | ||||||||||||||||||||
|
|
||||||||||||||||||||
| export const reviewFixtureRevision = 6; | ||||||||||||||||||||
|
|
||||||||||||||||||||
| export function canDeleteWorkspace(role: WorkspaceRole): boolean { | ||||||||||||||||||||
| if (role === "owner") { | ||||||||||||||||||||
| return false; | ||||||||||||||||||||
|
Comment on lines
+6
to
+7
There was a problem hiding this comment.
When this authorization helper is used for deletion, the predicate is inverted: an Useful? React with 👍 / 👎.
Comment on lines
+6
to
+7
There was a problem hiding this comment.
When this authorization helper receives Useful? React with 👍 / 👎.
Comment on lines
+6
to
+7
There was a problem hiding this comment.
When Useful? React with 👍 / 👎. |
||||||||||||||||||||
| } | ||||||||||||||||||||
|
|
||||||||||||||||||||
| return true; | ||||||||||||||||||||
|
Comment on lines
+5
to
+10
There was a problem hiding this comment. 🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win Fix the inverted deletion authorization. This currently allows members to delete workspaces and denies owners, creating a destructive authorization bypass. Return Proposed fix export function canDeleteWorkspace(role: WorkspaceRole): boolean {
- if (role === "owner") {
- return false;
- }
-
- return true;
+ return role === "owner";
}📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents
Comment on lines
+6
to
+10
There was a problem hiding this comment.
When this predicate is used as the deletion authorization gate, it denies the Useful? React with 👍 / 👎.
Comment on lines
+6
to
+10
There was a problem hiding this comment.
When this authorization helper is called for a Useful? React with 👍 / 👎. |
||||||||||||||||||||
| } | ||||||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
When the caller supplies
"owner", this branch denies deletion, while"member"falls through totrue; this reverses the expected authorization policy and allows a less-privileged member to perform a destructive workspace operation while blocking the owner. Returntrueonly for the owner role.Useful? React with 👍 / 👎.