db39fe7752
* fix(api): scope routine remove to acting user in shared Spaces routines/remove only filtered by spaceId, so any member of a shared Space could delete another member's routine by ID. Match update/testRun by also requiring userId in the lookup. Co-authored-by: cynarAI <cynarAI@users.noreply.github.com> * test: drop unused ownerActor in routine remove authz case Co-authored-by: cynarAI <cynarAI@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
19 lines
721 B
TypeScript
19 lines
721 B
TypeScript
import { readFileSync } from "node:fs";
|
|
import { dirname, resolve } from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
import { describe, expect, it } from "vitest";
|
|
|
|
describe("routine remove authorization wiring", () => {
|
|
it("scopes remove lookups to the acting user like update and testRun", () => {
|
|
const routerSource = readFileSync(
|
|
resolve(dirname(fileURLToPath(import.meta.url)), "router.ts"),
|
|
"utf8",
|
|
);
|
|
const removeHandler = routerSource.match(
|
|
/remove: authed\.routines\.remove\.handler\(async \(\{ context, input \}\) => \{[\s\S]*?\}\),/,
|
|
)?.[0];
|
|
expect(removeHandler).toBeTruthy();
|
|
expect(removeHandler).toContain("userId: context.actor.userId");
|
|
});
|
|
});
|