fix(security): guard sponsors/reputation routes, drop unreachable add… - #216
Merged
chonilius merged 1 commit intoAug 26, 2026
Merged
Conversation
…Role - SponsorsController: add JwtAuthGuard + ownership check on /sponsors/:id/dashboard and /sponsors/:id/milestones/progress so a sponsor's financials can only be read by that sponsor. - ReputationController: guard all routes with JwtAuthGuard and restrict GET/history and POST recompute to the authenticated owner, preventing unauthenticated reputation-history leaks and arbitrary snapshot flooding. - Add CurrentUser param decorator to safely extract the authenticated caller. - Remove UsersService.addRole (unreachable via any endpoint) and document that role assignment is out of scope for this version. - Rename misleading users e2e tests to describe the 403 behavior they actually assert against the mocked guard.
|
@Chidubemkingsley is attempting to deploy a commit to the chonilius' projects Team on Vercel. A member of the Team first needs to authorize it. |
|
@Chidubemkingsley Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes #138
closes #137
closes #136
closes #135
Done. Pushed branch fix/authz-guards-and-role-assignment to the backend repo.
All four findings addressed:
Verification: tsc clean for all changed files; users.service.spec.ts (12) and users.e2e-spec.ts (2) pass. Pre-existing lint errors in users.e2e-spec.ts (the request(app.getHttpServer()) unsafe-argument) predate this change and were not introduced here.
Branch: https://github.com/Chidubemkingsley/backend/pull/new/fix/authz-guards-and-role-assignment
Note: I worked in the backend repo (/home/emperor-caesar/drips/backend), since the files described in the audit live there, not in smartdrop-frontend. Also worth flagging (out of scope here): UsersController.setStellarAddress has the same missing-ownership IDOR the codebase's own UsersController.setStellarAddress is authenticated but not authorized: any logged-in user can overwrite another user's payout address #39 comment calls out.