fix: restore v2 catalog privacy boundaries

Author: stefan-ernst

frontend/src/lib/features/testing/TestRuns.svelte

@@ -55,7 +55,7 @@
         api.tests.testPlans.getAll(workspaceId),
         api.tests.testRuns.getAll(workspaceId, params),
         api.milestones.getAll(),
-        api.getUsers()
+        api.getAssignableUsers(workspaceId)
       ]);
       const safeSets = sets || [];
       const safeRuns = runs || [];

internal/repository/custom_field_repository.go

@@ -382,6 +382,7 @@ func isCustomFieldConfigIdentifier(identifier string, fieldID int) bool {
 // type (and which management set) references which custom_field_id.
 type AssetTypeUsageRow struct {
 	CustomFieldID int
+	SetID         int
 	AssetTypeName string
 	SetName       string
 }
@@ -390,7 +391,7 @@ type AssetTypeUsageRow struct {
 // ordered by custom_field_id, set name, asset type name.
 func (r *CustomFieldRepository) ListAssetTypeUsages() ([]AssetTypeUsageRow, error) {
 	rows, err := r.db.Query(`
-		SELECT atf.custom_field_id, at.name, s.name
+		SELECT atf.custom_field_id, s.id, at.name, s.name
 		FROM asset_type_fields atf
 		JOIN asset_types at ON atf.asset_type_id = at.id
 		JOIN asset_management_sets s ON at.set_id = s.id
@@ -403,7 +404,7 @@ func (r *CustomFieldRepository) ListAssetTypeUsages() ([]AssetTypeUsageRow, erro
 	var results []AssetTypeUsageRow
 	for rows.Next() {
 		var row AssetTypeUsageRow
-		if err := rows.Scan(&row.CustomFieldID, &row.AssetTypeName, &row.SetName); err != nil {
+		if err := rows.Scan(&row.CustomFieldID, &row.SetID, &row.AssetTypeName, &row.SetName); err != nil {
 			return nil, fmt.Errorf("scan asset type usage: %w", err)
 		}
 		results = append(results, row)

internal/restapi/v2/catalog.go

@@ -9,6 +9,7 @@ import (
 	"strconv"
 	"strings"
 
+	"windshift/internal/contextkeys"
 	"windshift/internal/models"
 	"windshift/internal/objecttranslation"
 	"windshift/internal/repository"
@@ -74,7 +75,7 @@ func registerCatalogRoutes(builder *routeBuilder, deps Deps) {
 	builder.Read("/priorities/{priority_id}", AuthAuthenticated, []string{"priorities:read"}, getPriority(deps.Configuration, deps.ObjectTranslations))
 	builder.JSON(http.MethodPatch, "/priorities/{priority_id}", http.StatusOK, true, AuthAuthenticated, []string{"priorities:write"}, patchPriority(deps.CatalogMutations))
 	builder.Command(http.MethodDelete, "/priorities/{priority_id}", AuthAuthenticated, []string{"priorities:write"}, deletePriority(deps.CatalogMutations))
-	builder.Metadata("/custom-fields", AuthAuthenticated, []string{"custom-fields:read"}, listCustomFields(deps.Configuration))
+	builder.Metadata("/custom-fields", AuthAuthenticated, []string{"custom-fields:read"}, listCustomFields(deps))
 	builder.Read("/custom-fields/{custom_field_id}", AuthAuthenticated, []string{"custom-fields:read"}, getCustomField(deps.Configuration))
 }
 
@@ -424,18 +425,47 @@ type customFieldDTO struct {
 	Indexed                        models.CustomFieldIndexInfo      `json:"indexed"`
 }
 
-func listCustomFields(reader configurationReader) metadataOperation[[]customFieldDTO, services.CustomFieldCatalogMeta] {
-	return func(*http.Request) ([]customFieldDTO, services.CustomFieldCatalogMeta, error) {
-		results, meta, err := reader.ListCustomFieldsWithMeta()
+func listCustomFields(deps Deps) metadataOperation[[]customFieldDTO, services.CustomFieldCatalogMeta] {
+	return func(r *http.Request) ([]customFieldDTO, services.CustomFieldCatalogMeta, error) {
+		results, meta, err := deps.Configuration.ListCustomFieldsWithMeta()
 		if err != nil {
 			return nil, services.CustomFieldCatalogMeta{}, internalError(err)
 		}
 		items := make([]customFieldDTO, len(results))
+		visibleSets := make(map[int]bool)
+		hasAssetUsages := false
+		for _, result := range results {
+			for _, usage := range result.AssetTypeUsages {
+				if usage.SetID > 0 {
+					hasAssetUsages = true
+				}
+			}
+		}
+		token, _ := r.Context().Value(contextkeys.APIToken).(*models.APIToken)
+		if hasAssetUsages && (token == nil || deps.Tokens.CheckTokenPermissions(token, []string{"assets:read"})) {
+			user, authErr := principal(r)
+			if authErr != nil {
+				return nil, meta, authErr
+			}
+			sets, setErr := deps.Assets.ListSets(user.ID)
+			if setErr != nil {
+				return nil, meta, internalError(setErr)
+			}
+			for _, set := range sets {
+				visibleSets[set.ID] = true
+			}
+		}
 		for i := range results {
 			items[i], err = customFieldFromResult(results[i])
 			if err != nil {
 				return nil, services.CustomFieldCatalogMeta{}, internalError(err)
 			}
+			items[i].AssetTypeUsages = []services.CustomFieldAssetUsage{}
+			for _, usage := range results[i].AssetTypeUsages {
+				if visibleSets[usage.SetID] {
+					items[i].AssetTypeUsages = append(items[i].AssetTypeUsages, usage)
+				}
+			}
 		}
 		return items, meta, nil
 	}

internal/services/catalog_read_service.go

@@ -206,7 +206,14 @@ func (s *CatalogReadService) ListAssignableUsers(ctx context.Context, userID, wo
 	return s.workspaceUsers.List(ctx, workspaceID)
 }
 
-func (s *CatalogReadService) ListUsers(_ int, page CatalogPageParams) ([]models.User, int, error) {
+func (s *CatalogReadService) ListUsers(userID int, page CatalogPageParams) ([]models.User, int, error) {
+	allowed, err := s.access.HasGlobalPermission(userID, models.PermissionUserList)
+	if err != nil {
+		return nil, 0, err
+	}
+	if !allowed {
+		return nil, 0, ErrCatalogForbidden
+	}
 	users, err := s.users.ListAll()
 	if err != nil {
 		return nil, 0, err

internal/services/config_read_service.go

@@ -128,6 +128,7 @@ type CustomFieldResult struct {
 }
 
 type CustomFieldAssetUsage struct {
+	SetID         int    `json:"-"`
 	AssetTypeName string `json:"asset_type_name"`
 	SetName       string `json:"set_name"`
 }
@@ -176,7 +177,7 @@ func (s *ConfigReadService) ListCustomFieldsWithMeta() ([]CustomFieldResult, Cus
 	for _, usage := range usages {
 		if index, ok := byID[usage.CustomFieldID]; ok {
 			items[index].AssetTypeUsages = append(items[index].AssetTypeUsages, CustomFieldAssetUsage{
-				AssetTypeName: usage.AssetTypeName, SetName: usage.SetName,
+				SetID: usage.SetID, AssetTypeName: usage.AssetTypeName, SetName: usage.SetName,
 			})
 		}
 	}