github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-08-27 15:19:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

🐛 Require edition permissions for get-team-invitation-token

Browse Source 
The handler previously allowed any team member (including viewers) to
generate invitation tokens. Now requires at least edition-level
permissions (can-edit, admin, or owner).

Closes #11358

AI-assisted-by: longcat-2.0
This commit is contained in:
Andrey Antukh 2026-08-25 13:35:21 +00:00
parent 7079d33ae1
commit 4adfa5d2f2
2 changed files with 24 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
backend/src/app/rpc/commands/teams_invitations.clj
View File

@ -603,7 +603,7 @@
::doc/module :teams ::doc/module :teams
::sm/params schema:get-team-invitation-token} ::sm/params schema:get-team-invitation-token}
[{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id team-id email] :as params}] [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id team-id email] :as params}]
(teams/check-read-permissions! cfg profile-id team-id) (teams/check-edition-permissions! cfg profile-id team-id)
(let [email (profile/clean-email email) (let [email (profile/clean-email email)
invit (-> (db/get pool :team-invitation invit (-> (db/get pool :team-invitation
{:team-id team-id {:team-id team-id

31
backend/test/backend_tests/rpc_team_test.clj
View File

@ -357,6 +357,28 @@
(t/is (= (:id profile2) (:member-id claims)))))))) (t/is (= (:id profile2) (:member-id claims))))))))
(t/deftest get-team-invitation-token-requires-edition-permissions
(let [profile1 (th/create-profile* 1 {:is-active true})
profile2 (th/create-profile* 2 {:is-active true})
team (th/create-team* 1 {:profile-id (:id profile1)})
pool (:app.db/pool th/*system*)]
(th/create-team-role* {:team-id (:id team)
:profile-id (:id profile2)
:role :viewer})
(db/insert! pool :team-invitation
{:team-id (:id team)
:email-to "victim@example.com"
:role "editor"
:valid-until (ct/in-future "48h")})
(let [data {::th/type :get-team-invitation-token
::rpc/profile-id (:id profile2)
:team-id (:id team)
:email "victim@example.com"}
out (th/command! data)]
(t/is (not (th/success? out)))
(t/is (= :not-found (-> out :error ex-data :type))))))
(t/deftest accept-invitation-tokens (t/deftest accept-invitation-tokens
(let [profile1 (th/create-profile* 1 {:is-active true}) (let [profile1 (th/create-profile* 1 {:is-active true})
profile2 (th/create-profile* 2 {:is-active true}) profile2 (th/create-profile* 2 {:is-active true})
@ -366,14 +388,7 @@
pool (:app.db/pool th/*system*)] pool (:app.db/pool th/*system*)]
(let [token (tokens/generate th/*system* (let [token (tokens/generate th/*system*)]
{:iss :team-invitation
:exp (ct/in-future "1h")
:profile-id (:id profile1)
:role :editor
:team-id (:id team)
:member-email (:email profile2)
:member-id (:id profile2)})]
(t/testing "Verify token as anonymous user" (t/testing "Verify token as anonymous user"
(db/insert! pool :team-invitation (db/insert! pool :team-invitation