feat(backend): enforce mission-level read access controls for GET /triggers and GET /triggers/:uuid endpoints

Author: LevinCeglie

backend/src/endpoints/trigger/trigger.controller.ts

@@ -32,18 +32,20 @@ export class TriggerController {
     @LoggedIn()
     @ApiOkResponse({ type: ActionTriggerDto, isArray: true })
     async findAll(
+        @AddUser() auth: AuthHeader,
         @Query('missionUuid') missionUuid?: string,
     ): Promise<ActionTriggerDto[]> {
-        return this.triggerService.findAll(missionUuid);
+        return this.triggerService.findAll(auth.user, missionUuid);
     }
 
     @Get(':uuid')
     @LoggedIn()
     @ApiOkResponse({ type: ActionTriggerDto })
     async findOne(
         @ParameterUuid('uuid') uuid: string,
+        @AddUser() auth: AuthHeader,
     ): Promise<ActionTriggerDto> {
-        return this.triggerService.findOne(uuid);
+        return this.triggerService.findOne(uuid, auth.user);
     }
 
     @Post()

backend/src/services/trigger.service.ts

@@ -1,3 +1,4 @@
+import { MissionGuardService } from '@/endpoints/auth/mission-guard.service';
 import {
     ActionTriggerDto,
     CreateActionTriggerDto,
@@ -12,13 +13,16 @@ import {
 import { redis } from '@kleinkram/backend-common/consts';
 import { ActionDispatcherService } from '@kleinkram/backend-common/modules/action-dispatcher/action-dispatcher.service';
 import {
+    AccessGroupRights,
     ActionTriggerSource,
     isValidCron,
     TriggerEvent,
     TriggerType,
+    UserRole,
 } from '@kleinkram/shared';
 import {
     BadRequestException,
+    ForbiddenException,
     Injectable,
     NotFoundException,
     OnModuleInit,
@@ -43,13 +47,28 @@ export class TriggerService implements OnModuleInit {
         @InjectRepository(MissionEntity)
         private missionRepository: Repository<MissionEntity>,
         private readonly actionDispatcher: ActionDispatcherService,
+        private readonly missionGuardService: MissionGuardService,
     ) {}
 
     onModuleInit(): void {
         this.triggerQueue = new Queue('trigger-queue', { redis });
     }
 
-    async findAll(missionUuid?: string): Promise<ActionTriggerDto[]> {
+    async findAll(
+        user: UserEntity,
+        missionUuid?: string,
+    ): Promise<ActionTriggerDto[]> {
+        if (missionUuid && user.role !== UserRole.ADMIN) {
+            const hasAccess = await this.missionGuardService.canAccessMission(
+                user,
+                missionUuid,
+                AccessGroupRights.READ,
+            );
+            if (!hasAccess) {
+                throw new ForbiddenException('Forbidden resource');
+            }
+        }
+
         const query = this.triggerRepository
             .createQueryBuilder('trigger')
             .leftJoinAndSelect('trigger.template', 'template')
@@ -59,10 +78,31 @@ export class TriggerService implements OnModuleInit {
             query.where('trigger.missionUuid = :missionUuid', { missionUuid });
         }
         const entities = await query.getMany();
+
+        if (!missionUuid && user.role !== UserRole.ADMIN) {
+            const allowedEntities: ActionTriggerEntity[] = [];
+            for (const entity of entities) {
+                if (entity.creatorUuid === user.uuid) {
+                    allowedEntities.push(entity);
+                } else {
+                    const hasAccess =
+                        await this.missionGuardService.canAccessMission(
+                            user,
+                            entity.missionUuid,
+                            AccessGroupRights.READ,
+                        );
+                    if (hasAccess) {
+                        allowedEntities.push(entity);
+                    }
+                }
+            }
+            return allowedEntities.map((entity) => this.toDto(entity));
+        }
+
         return entities.map((entity) => this.toDto(entity));
     }
 
-    async findOne(uuid: string): Promise<ActionTriggerDto> {
+    async findOne(uuid: string, user: UserEntity): Promise<ActionTriggerDto> {
         const trigger = await this.triggerRepository.findOne({
             where: { uuid },
             relations: { template: true, mission: true, creator: true },
@@ -72,6 +112,17 @@ export class TriggerService implements OnModuleInit {
             throw new NotFoundException('Trigger not found');
         }
 
+        if (user.role !== UserRole.ADMIN && trigger.creatorUuid !== user.uuid) {
+            const hasAccess = await this.missionGuardService.canAccessMission(
+                user,
+                trigger.missionUuid,
+                AccessGroupRights.READ,
+            );
+            if (!hasAccess) {
+                throw new ForbiddenException('Forbidden resource');
+            }
+        }
+
         return this.toDto(trigger);
     }
 

backend/tests/triggers/trigger-ownership.test.ts

@@ -180,7 +180,7 @@ describe('Trigger Ownership API Tests', () => {
         expect(response.status).toBe(200);
     });
 
-    test('User B should be able to read User A trigger', async () => {
+    test('User B should NOT be able to read User A trigger', async () => {
         const trigger = await createTrigger(userA, {
             name: 'User A Trigger',
             description: 'Owned by User A',
@@ -199,10 +199,7 @@ describe('Trigger Ownership API Tests', () => {
             },
         );
 
-        expect(response.status).toBe(200);
-        const body = (await response.json()) as { uuid: string; name: string };
-        expect(body.uuid).toBe(trigger.uuid);
-        expect(body.name).toBe('User A Trigger');
+        expect(response.status).toBe(403);
     });
 
     test('Should return 404 for non-existent trigger', async () => {