Repository navigation
Conversation
POST and PATCH /note/:notePublicId/relation only checked that the user can edit the child note. The parent passed in parentNoteId was never checked, so a user could put their own note under anyone's note. Both handlers now require a Write role on the parent (same rule as the userCanEdit policy) and reply 403 otherwise. An unknown parent is still left to the note service, so its 400 responses are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Coverage Report
File Coverage
|
||||||||||||||||||||||||||||||||||||||
…on-parent-permission
Replace the router helper with parentNoteResolver and the userCanEditParentNote policy from #310. An unknown parent note now gets 406 "Parent note not found" from the resolver, as in POST /note. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
neSpecc
changed the base branch from
main
to
fix/check-parent-note-permission
October 21, 2026 00:55
neSpecc
added this pull request to stack #312
October 21, 2026 01:18
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
POSTandPATCH /note/:notePublicId/relationuse theauthRequiredanduserCanEditpolicies, butuserCanEditonly checks the child note from the URL. The parent named inparentNoteIdwas never checked, andNoteService.createNoteRelation/updateNoteRelationtake no user id. So a user could put their own note under anyone else's note.This is the same gap #310 closes for
POST /notewithparentId.Changes
parentNoteResolvermiddleware and theuserCanEditParentNotepolicy added in fix: check edit permission on parent note in POST /note #310. The resolver readsparentNoteIdfrom the body. The policy requiresMemberRole.Writeon the parent (same rule asuserCanEdit, a role inherited from an ancestor's team counts) and replies 403You don't have permission to edit the parent noteotherwise.Parent note not foundfrom the resolver, instead of 400Incorrect parent note Id(POST) /Incorrect parent note(PATCH) from the service. The two existing tests are updated.note.test.ts: for both routes, a user who is not in the parent's team and a user withMemberRole.Readget 403, and a follow-upGETshows the relation did not change. These four fail againstmain.Testing
yarn typecheck,yarn eslint srcandyarn vitest runpass locally (173 tests, together with #310).🤖 Generated with Claude Code