[neSpecc]

Problem

POST /note accepts a parentId, but the handler only had the authRequired policy. NoteService.addNote checked that the parent exists, and only after the child note was already saved. So any logged-in user could attach a note to someone else's note tree. Because the existence check came last, an unknown parentId also left an orphan note (and its history record) behind, even though the request returned 400.

Changes

• New parentNoteResolver middleware (src/presentation/http/middlewares/note/useParentNoteResolver.ts). It reads the parent's public id from parentId (this route) or parentNoteId (relation routes, see fix: check edit permission on parent note in relation routes #311), resolves it into request.parentNote, and replies 406 Parent note not found if it does not exist, the same way noteResolver handles an unknown note. A request without a parent id is left alone.
• New userCanEditParentNote policy (src/presentation/http/policies/userCanEditParentNote.ts). It requires MemberRole.Write on request.parentNote (same rule as userCanEdit, a role inherited from an ancestor's team counts) and replies 403 You don't have permission to edit the parent note otherwise. If the body has no parentId or parentNoteId, there is nothing to check. If it has one but request.parentNote is empty (the route forgot parentNoteResolver), the policy replies 406 Parent note not found instead of letting the request through.
• POST /note uses the resolver and the policy. Since the parent is resolved before the handler, an unknown parentId no longer leaves an orphan note.
• Behaviour change: an unknown parentId now gets 406 Parent note not found instead of 400 Note with public id … was not found.
• Tests in note.test.ts:
  • a user who is not in the parent's team and a user with MemberRole.Read both get 403 You don't have permission to edit the parent note;
  • an unknown parentId gets 406 and leaves no notes or note_history row (fails on main because of the orphan);
  • the existing parent relation test still passes;
  • unit tests in userCanEditParentNote.test.ts: with a parent id in the body but no resolved parent note, the policy replies 406 and does not check the role.

Testing

yarn typecheck, yarn eslint src and yarn vitest run pass locally (169 tests).

🤖 Generated with Claude Code

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🟢	Lines	85.93% (🎯 80%) ⬆️ +0.12 pp	9431 / 10975
🟢	Statements	85.93% (🎯 80%) ⬆️ +0.12 pp	9431 / 10975
🔴	Functions	79.83% (🎯 80%) ⬆️ +0.23 pp	289 / 362
🟢	Branches	85% (🎯 80%) ⬆️ +0.11 pp	493 / 580

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
src/presentation/http/middlewares/note/useParentNoteResolver.ts	96.36%	83.33%	100%	96.36%	32-33
src/presentation/http/policies/index.ts	100% 🟰 ±0 pp	100% 🟰 ±0 pp	100% 🟰 ±0 pp	100% 🟰 ±0 pp
src/presentation/http/policies/userCanEditParentNote.ts	95.08%	91.66%	100%	95.08%	28-30
src/presentation/http/router/note.ts	97.99% ⬆️ +0.03 pp	79.41% 🟰 ±0 pp	100% 🟰 ±0 pp	97.99% ⬆️ +0.03 pp	162-163, 640-641, 657-663, 724-725, 781-782, 833-834

Generated in workflow #948 for commit 03aa8a7 by the Vitest Coverage Report Action

[Copilot]

🟢 Approval recommended

No blocking issues were identified; the remaining suggestion is an optional orphan-prevention regression test.

1 open issue

• Add regression test preventing orphan notes for nonexistent parentId · New

What changed in this PR

Prevents unauthorized child-note creation by checking parent edit permissions before saving.

Changes:

• Requires Write access to the parent, including inherited access.
• Rejects unknown parents before persistence.
• Adds tests for nonmembers and read-only members.

File	Description
src/​presentation/​http/​router/​note.ts	Validates parent existence and edit permission before creation.
src/​presentation/​http/​router/​note.test.ts	Tests rejection of users without parent edit access.

_{Review effort: Balanced}