requested changes

backend/src/server/routes/v1/secret-requests-router.ts

@@ -44,7 +44,6 @@ export const registerSecretRequestsRouter = async (server: FastifyZodProvider) =
       const secretRequest = await req.server.services.secretSharing.getSecretRequestById({
         id: req.params.id,
         actorOrgId: req.permission?.orgId,
-        orgId: req.permission?.orgId,
         actor: req.permission?.type,
         actorId: req.permission?.id,
         actorAuthMethod: req.permission?.authMethod
@@ -82,7 +81,6 @@ export const registerSecretRequestsRouter = async (server: FastifyZodProvider) =
       const secretRequest = await req.server.services.secretSharing.setSecretRequestValue({
         id: req.params.id,
         actorOrgId: req.permission?.orgId,
-        orgId: req.permission?.orgId,
         actor: req.permission?.type,
         actorId: req.permission?.id,
         actorAuthMethod: req.permission?.authMethod,

backend/src/services/secret-sharing/secret-sharing-dal.ts

@@ -2,7 +2,7 @@ import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
 import { TableName, TSecretSharing } from "@app/db/schemas";
-import { DatabaseError } from "@app/lib/errors";
+import { DatabaseError, NotFoundError } from "@app/lib/errors";
 import { ormify, selectAllTableCols } from "@app/lib/knex";
 import { logger } from "@app/lib/logger";
 import { QueueName } from "@app/queue";
@@ -32,10 +32,8 @@ export const secretSharingDALFactory = (db: TDbClient) => {
       .first();
 
     if (!secretRequest) {
-      throw new DatabaseError({
-        error: new Error("Get Secret Request By Id, Not found"),
-        message: "Get Secret Request By Id, Not found",
-        name: "GetSecretRequestById"
+      throw new NotFoundError({
+        message: `Secret request with ID '${id}' not found`
       });
     }
 

backend/src/services/secret-sharing/secret-sharing-service.ts

@@ -176,7 +176,6 @@ export const secretSharingServiceFactory = ({
     id,
     actor,
     actorId,
-    orgId,
     actorAuthMethod,
     actorOrgId
   }: TGetSecretRequestByIdDTO) => {
@@ -187,22 +186,22 @@ export const secretSharingServiceFactory = ({
     }
 
     if (secretRequest.accessType === SecretSharingAccessType.Organization) {
-      if (orgId === undefined) {
+      if (!secretRequest.orgId) {
+        throw new BadRequestError({ message: "No organization ID present on secret request" });
+      }
+
+      if (!actorOrgId) {
         throw new UnauthorizedError();
       }
 
       const { permission } = await permissionService.getOrgPermission(
         actor,
         actorId,
-        orgId,
+        secretRequest.orgId,
         actorAuthMethod,
         actorOrgId
       );
       if (!permission) throw new ForbiddenRequestError({ name: "User is not a part of the specified organization" });
-
-      if (secretRequest.orgId !== orgId) {
-        throw new ForbiddenRequestError({ name: "User does not have permission to access this secret request" });
-      }
     }
 
     if (secretRequest.expiresAt && secretRequest.expiresAt < new Date()) {
@@ -221,7 +220,6 @@ export const secretSharingServiceFactory = ({
     id,
     actor,
     actorId,
-    orgId,
     actorAuthMethod,
     actorOrgId,
     secretValue
@@ -237,23 +235,23 @@ export const secretSharingServiceFactory = ({
     let respondentUsername: string | undefined;
 
     if (secretRequest.accessType === SecretSharingAccessType.Organization) {
+      if (!secretRequest.orgId) {
+        throw new BadRequestError({ message: "No organization ID present on secret request" });
+      }
+
+      if (!actorOrgId) {
+        throw new UnauthorizedError();
+      }
+
       const { permission } = await permissionService.getOrgPermission(
         actor,
         actorId,
-        orgId,
+        secretRequest.orgId,
         actorAuthMethod,
         actorOrgId
       );
       if (!permission) throw new ForbiddenRequestError({ name: "User is not a part of the specified organization" });
 
-      if (!orgId) {
-        throw new UnauthorizedError();
-      }
-
-      if (secretRequest.orgId !== orgId) {
-        throw new ForbiddenRequestError({ name: "User does not have permission to access this secret request" });
-      }
-
       const user = await userDAL.findById(actorId);
 
       if (!user) {
@@ -478,8 +476,14 @@ export const secretSharingServiceFactory = ({
       ? await secretSharingDAL.findOne({ id: sharedSecretId, type: deleteSharedSecretInput.type })
       : await secretSharingDAL.findOne({ identifier: sharedSecretId, type: deleteSharedSecretInput.type });
 
-    if (sharedSecret.orgId && sharedSecret.orgId !== orgId)
+    if (sharedSecret.userId !== actorId) {
+      throw new ForbiddenRequestError({
+        message: "User does not have permission to delete shared secret"
+      });
+    }
+    if (sharedSecret.orgId && sharedSecret.orgId !== orgId) {
       throw new ForbiddenRequestError({ message: "User does not have permission to delete shared secret" });
+    }
 
     const deletedSharedSecret = await secretSharingDAL.deleteById(sharedSecretId);
 

backend/src/services/secret-sharing/secret-sharing-types.ts

@@ -57,12 +57,12 @@ export type TRevealSecretRequestValueDTO = {
 
 export type TGetSecretRequestByIdDTO = {
   id: string;
-} & TOrgPermission;
+} & Omit<TOrgPermission, "orgId">;
 
 export type TSetSecretRequestValueDTO = {
   id: string;
   secretValue: string;
-} & TOrgPermission;
+} & Omit<TOrgPermission, "orgId">;
 
 export type TDeleteSharedSecretDTO = {
   sharedSecretId: string;