Skip to content

Conversation

@hexawulf
Copy link
Owner

Resolves data isolation issue where you could see snippets from other accounts.

Changes:

  • Modified DatabaseStorage.getSnippets in server/storage.ts to accept an optional userId filter and apply it to the database query.
  • Modified SimpleStorage.getSnippets in server/simple-storage.ts to accept an optional userId filter and apply it to the database query.
  • Applied authMiddleware to the GET /api/snippets endpoint in server/routes.ts to enforce authentication.
  • The GET /api/snippets endpoint now extracts the authenticated userId and passes it to the storage methods (storage.getSnippets and simpleStorage.getSnippets) to ensure you only retrieve your own snippets.
  • Updated the fallback direct database query in GET /api/snippets to also filter by userId.

Testing:

  • Added new API tests in server/__tests__/routes.test.ts with multiple mock users.
  • Tests verify that:
    • Authenticated users only retrieve their own snippets via GET /api/snippets.
    • Unauthenticated requests to GET /api/snippets are rejected (401).
    • Users with no snippets receive an empty array.
  • Existing tests for public snippet access (/api/public/snippets) were preserved and confirmed to be working correctly.

Resolves data isolation issue where you could see snippets from other accounts.

Changes:
- Modified `DatabaseStorage.getSnippets` in `server/storage.ts` to accept an optional `userId` filter and apply it to the database query.
- Modified `SimpleStorage.getSnippets` in `server/simple-storage.ts` to accept an optional `userId` filter and apply it to the database query.
- Applied `authMiddleware` to the `GET /api/snippets` endpoint in `server/routes.ts` to enforce authentication.
- The `GET /api/snippets` endpoint now extracts the authenticated `userId` and passes it to the storage methods (`storage.getSnippets` and `simpleStorage.getSnippets`) to ensure you only retrieve your own snippets.
- Updated the fallback direct database query in `GET /api/snippets` to also filter by `userId`.

Testing:
- Added new API tests in `server/__tests__/routes.test.ts` with multiple mock users.
- Tests verify that:
    - Authenticated users only retrieve their own snippets via `GET /api/snippets`.
    - Unauthenticated requests to `GET /api/snippets` are rejected (401).
    - Users with no snippets receive an empty array.
- Existing tests for public snippet access (`/api/public/snippets`) were preserved and confirmed to be working correctly.
@hexawulf hexawulf merged commit 0b38af7 into main May 26, 2025
1 check failed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants