diff --git a/backend/src/server/routes/v1/secret-requests-router.ts b/backend/src/server/routes/v1/secret-requests-router.ts index f3197a762..a1e4eafc2 100644 --- a/backend/src/server/routes/v1/secret-requests-router.ts +++ b/backend/src/server/routes/v1/secret-requests-router.ts @@ -44,7 +44,6 @@ export const registerSecretRequestsRouter = async (server: FastifyZodProvider) = const secretRequest = await req.server.services.secretSharing.getSecretRequestById({ id: req.params.id, actorOrgId: req.permission?.orgId, - orgId: req.permission?.orgId, actor: req.permission?.type, actorId: req.permission?.id, actorAuthMethod: req.permission?.authMethod @@ -82,7 +81,6 @@ export const registerSecretRequestsRouter = async (server: FastifyZodProvider) = const secretRequest = await req.server.services.secretSharing.setSecretRequestValue({ id: req.params.id, actorOrgId: req.permission?.orgId, - orgId: req.permission?.orgId, actor: req.permission?.type, actorId: req.permission?.id, actorAuthMethod: req.permission?.authMethod, diff --git a/backend/src/services/secret-sharing/secret-sharing-dal.ts b/backend/src/services/secret-sharing/secret-sharing-dal.ts index a17e37923..7cdccd4f8 100644 --- a/backend/src/services/secret-sharing/secret-sharing-dal.ts +++ b/backend/src/services/secret-sharing/secret-sharing-dal.ts @@ -2,7 +2,7 @@ import { Knex } from "knex"; import { TDbClient } from "@app/db"; import { TableName, TSecretSharing } from "@app/db/schemas"; -import { DatabaseError } from "@app/lib/errors"; +import { DatabaseError, NotFoundError } from "@app/lib/errors"; import { ormify, selectAllTableCols } from "@app/lib/knex"; import { logger } from "@app/lib/logger"; import { QueueName } from "@app/queue"; @@ -32,10 +32,8 @@ export const secretSharingDALFactory = (db: TDbClient) => { .first(); if (!secretRequest) { - throw new DatabaseError({ - error: new Error("Get Secret Request By Id, Not found"), - message: "Get Secret Request By Id, Not found", - name: "GetSecretRequestById" + throw new NotFoundError({ + message: `Secret request with ID '${id}' not found` }); } diff --git a/backend/src/services/secret-sharing/secret-sharing-service.ts b/backend/src/services/secret-sharing/secret-sharing-service.ts index 45ca9bb2a..1ce7acf44 100644 --- a/backend/src/services/secret-sharing/secret-sharing-service.ts +++ b/backend/src/services/secret-sharing/secret-sharing-service.ts @@ -176,7 +176,6 @@ export const secretSharingServiceFactory = ({ id, actor, actorId, - orgId, actorAuthMethod, actorOrgId }: TGetSecretRequestByIdDTO) => { @@ -187,22 +186,22 @@ export const secretSharingServiceFactory = ({ } if (secretRequest.accessType === SecretSharingAccessType.Organization) { - if (orgId === undefined) { + if (!secretRequest.orgId) { + throw new BadRequestError({ message: "No organization ID present on secret request" }); + } + + if (!actorOrgId) { throw new UnauthorizedError(); } const { permission } = await permissionService.getOrgPermission( actor, actorId, - orgId, + secretRequest.orgId, actorAuthMethod, actorOrgId ); if (!permission) throw new ForbiddenRequestError({ name: "User is not a part of the specified organization" }); - - if (secretRequest.orgId !== orgId) { - throw new ForbiddenRequestError({ name: "User does not have permission to access this secret request" }); - } } if (secretRequest.expiresAt && secretRequest.expiresAt < new Date()) { @@ -221,7 +220,6 @@ export const secretSharingServiceFactory = ({ id, actor, actorId, - orgId, actorAuthMethod, actorOrgId, secretValue @@ -237,23 +235,23 @@ export const secretSharingServiceFactory = ({ let respondentUsername: string | undefined; if (secretRequest.accessType === SecretSharingAccessType.Organization) { + if (!secretRequest.orgId) { + throw new BadRequestError({ message: "No organization ID present on secret request" }); + } + + if (!actorOrgId) { + throw new UnauthorizedError(); + } + const { permission } = await permissionService.getOrgPermission( actor, actorId, - orgId, + secretRequest.orgId, actorAuthMethod, actorOrgId ); if (!permission) throw new ForbiddenRequestError({ name: "User is not a part of the specified organization" }); - if (!orgId) { - throw new UnauthorizedError(); - } - - if (secretRequest.orgId !== orgId) { - throw new ForbiddenRequestError({ name: "User does not have permission to access this secret request" }); - } - const user = await userDAL.findById(actorId); if (!user) { @@ -478,8 +476,14 @@ export const secretSharingServiceFactory = ({ ? await secretSharingDAL.findOne({ id: sharedSecretId, type: deleteSharedSecretInput.type }) : await secretSharingDAL.findOne({ identifier: sharedSecretId, type: deleteSharedSecretInput.type }); - if (sharedSecret.orgId && sharedSecret.orgId !== orgId) + if (sharedSecret.userId !== actorId) { + throw new ForbiddenRequestError({ + message: "User does not have permission to delete shared secret" + }); + } + if (sharedSecret.orgId && sharedSecret.orgId !== orgId) { throw new ForbiddenRequestError({ message: "User does not have permission to delete shared secret" }); + } const deletedSharedSecret = await secretSharingDAL.deleteById(sharedSecretId); diff --git a/backend/src/services/secret-sharing/secret-sharing-types.ts b/backend/src/services/secret-sharing/secret-sharing-types.ts index 0d2dd2393..835d70eff 100644 --- a/backend/src/services/secret-sharing/secret-sharing-types.ts +++ b/backend/src/services/secret-sharing/secret-sharing-types.ts @@ -57,12 +57,12 @@ export type TRevealSecretRequestValueDTO = { export type TGetSecretRequestByIdDTO = { id: string; -} & TOrgPermission; +} & Omit; export type TSetSecretRequestValueDTO = { id: string; secretValue: string; -} & TOrgPermission; +} & Omit; export type TDeleteSharedSecretDTO = { sharedSecretId: string; diff --git a/frontend/src/hooks/api/secretSharing/mutations.ts b/frontend/src/hooks/api/secretSharing/mutations.ts index 8b1485129..89390d532 100644 --- a/frontend/src/hooks/api/secretSharing/mutations.ts +++ b/frontend/src/hooks/api/secretSharing/mutations.ts @@ -5,7 +5,7 @@ import { apiRequest } from "@app/config/request"; import { secretSharingKeys } from "./queries"; import { TCreatedSharedSecret, - TCreateSecretRequestRequest, + TCreateSecretRequestRequestDTO, TCreateSharedSecretRequest, TDeleteSecretRequestDTO, TDeleteSharedSecretRequestDTO, @@ -48,7 +48,7 @@ export const useCreatePublicSharedSecret = () => { export const useCreateSecretRequest = () => { const queryClient = useQueryClient(); return useMutation({ - mutationFn: async (inputData: TCreateSecretRequestRequest) => { + mutationFn: async (inputData: TCreateSecretRequestRequestDTO) => { const { data } = await apiRequest.post( "/api/v1/secret-sharing/requests", inputData diff --git a/frontend/src/hooks/api/secretSharing/types.ts b/frontend/src/hooks/api/secretSharing/types.ts index 6461a1911..ab819cfb6 100644 --- a/frontend/src/hooks/api/secretSharing/types.ts +++ b/frontend/src/hooks/api/secretSharing/types.ts @@ -6,6 +6,7 @@ export type TSharedSecret = { updatedAt: Date; name: string | null; lastViewedAt?: Date; + accessType: SecretSharingAccessType; expiresAt: Date; expiresAfterViews: number | null; encryptedValue: string; @@ -33,7 +34,7 @@ export type TCreateSharedSecretRequest = { accessType?: SecretSharingAccessType; }; -export type TCreateSecretRequestRequest = { +export type TCreateSecretRequestRequestDTO = { name?: string; accessType?: SecretSharingAccessType; expiresAt: Date; diff --git a/frontend/src/pages/organization/SecretSharingPage/ShareSecretSection.tsx b/frontend/src/pages/organization/SecretSharingPage/ShareSecretSection.tsx index 81461040e..cce4f0a3d 100644 --- a/frontend/src/pages/organization/SecretSharingPage/ShareSecretSection.tsx +++ b/frontend/src/pages/organization/SecretSharingPage/ShareSecretSection.tsx @@ -3,7 +3,6 @@ import { useNavigate, useSearch } from "@tanstack/react-router"; import { Badge, Tab, TabList, TabPanel, Tabs } from "@app/components/v2"; import { ROUTE_PATHS } from "@app/const/routes"; -import { usePopUp } from "@app/hooks"; import { RequestSecretTab } from "./components/RequestSecret/RequestSecretTab"; import { ShareSecretTab } from "./components/ShareSecret/ShareSecretTab"; @@ -14,14 +13,6 @@ enum SecretSharingPageTabs { } export const ShareSecretSection = () => { - const { popUp, handlePopUpToggle, handlePopUpClose, handlePopUpOpen } = usePopUp([ - "createSharedSecret", - "deleteSharedSecretConfirmation", - "createSecretRequest", - "deleteSecretRequestConfirmation", - "revealSecretRequestValue" - ] as const); - const navigate = useNavigate(); const { selectedTab } = useSearch({ @@ -54,20 +45,10 @@ export const ShareSecretSection = () => { - + - + diff --git a/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RequestSecretForm.tsx b/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RequestSecretForm.tsx index 8b6d1e0b7..d8286b766 100644 --- a/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RequestSecretForm.tsx +++ b/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RequestSecretForm.tsx @@ -98,7 +98,12 @@ export const RequestSecretForm = () => { name="expiresIn" defaultValue="3600000" render={({ field: { onChange, ...field }, fieldState: { error } }) => ( - +