ob/sprint
1
0
Fork 0
mirror of https://github.com/hex248/sprint.git synced 2026-02-08 10:33:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

patched security holes

Browse Source
This commit is contained in:
Oliver Bryan
2026-01-21 22:44:57 +00:00
parent db0be8330e
commit be57b4d6df
11 changed files with 129 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
packages/backend/src/routes/project/create.ts
View File

@@ -1,6 +1,6 @@
import { ProjectCreateRequestSchema } from "@sprint/shared";
import type { AuthedRequest } from "../../auth/middleware";
import { createProject, getProjectByKey, getUserById } from "../../db/queries";
import { createProject, getOrganisationMemberRole, getProjectByKey, getUserById } from "../../db/queries";
import { errorResponse, parseJsonBody } from "../../validation";
export default async function projectCreate(req: AuthedRequest) {
@@ -14,6 +14,14 @@ export default async function projectCreate(req: AuthedRequest) {
return errorResponse(`project with key ${key} already exists in this organisation`, "KEY_TAKEN", 400);
}
const membership = await getOrganisationMemberRole(organisationId, req.userId);
if (!membership) {
return errorResponse("not a member of this organisation", "NOT_MEMBER", 403);
}
if (membership.role !== "owner" && membership.role !== "admin") {
return errorResponse("only owners and admins can create projects", "PERMISSION_DENIED", 403);
}
const creator = await getUserById(req.userId);
if (!creator) {
return errorResponse(`creator not found`, "CREATOR_NOT_FOUND", 404);