From 62a3b4738a45190cf00b3cdbfdd5bead6ec31588 Mon Sep 17 00:00:00 2001 From: oppiliappan Date: Thu, 9 Oct 2025 09:56:30 +0100 Subject: [PATCH] knotserver/xrpc: fix incorrect permission check in repo.deleteBranch the DID being used should be the repo-owner's DID and not the actor's DID. Signed-off-by: oppiliappan --- knotserver/xrpc/delete_branch.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/knotserver/xrpc/delete_branch.go b/knotserver/xrpc/delete_branch.go index 95d46946..e02bb343 100644 --- a/knotserver/xrpc/delete_branch.go +++ b/knotserver/xrpc/delete_branch.go @@ -57,14 +57,14 @@ func (x *Xrpc) DeleteBranch(w http.ResponseWriter, r *http.Request) { } repo := resp.Value.Val.(*tangled.Repo) - didPath, err := securejoin.SecureJoin(actorDid.String(), repo.Name) + didPath, err := securejoin.SecureJoin(ident.DID.String(), repo.Name) if err != nil { fail(xrpcerr.GenericError(err)) return } if ok, err := x.Enforcer.IsPushAllowed(actorDid.String(), rbac.ThisServer, didPath); !ok || err != nil { - l.Error("insufficent permissions", "did", actorDid.String()) + l.Error("insufficent permissions", "did", actorDid.String(), "repo", didPath) writeError(w, xrpcerr.AccessControlError(actorDid.String()), http.StatusUnauthorized) return } -- 2.51.2