From 97245c740e727ebfdb0bbf15075a9e25496ff46c Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Thu, 19 Sep 2024 01:05:31 +0800 Subject: [PATCH] misc: added as least as privileged check to update --- .../services/group-project/group-project-service.ts | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/backend/src/services/group-project/group-project-service.ts b/backend/src/services/group-project/group-project-service.ts index ba6528d28..fe9e68c55 100644 --- a/backend/src/services/group-project/group-project-service.ts +++ b/backend/src/services/group-project/group-project-service.ts @@ -256,6 +256,19 @@ export const groupProjectServiceFactory = ({ const projectGroup = await groupProjectDAL.findOne({ groupId: group.id, projectId: project.id }); if (!projectGroup) throw new BadRequestError({ message: `Failed to find group with slug ${groupSlug}` }); + for await (const { role: requestedRoleChange } of roles) { + const { permission: rolePermission } = await permissionService.getProjectPermissionByRole( + requestedRoleChange, + project.id + ); + + const hasRequiredPrivileges = isAtLeastAsPrivileged(permission, rolePermission); + + if (!hasRequiredPrivileges) { + throw new ForbiddenRequestError({ message: "Failed to assign group to a more privileged role" }); + } + } + // validate custom roles input const customInputRoles = roles.filter( ({ role }) => !Object.values(ProjectMembershipRole).includes(role as ProjectMembershipRole)