From 0e8ec37e61a44f662c862d14f67a85fae7649bb5 Mon Sep 17 00:00:00 2001 From: oppiliappan Date: Fri, 25 Jul 2025 08:26:01 +0000 Subject: [PATCH] appview: fix pull close/reopen permissions Signed-off-by: oppiliappan --- appview/pulls/pulls.go | 6 ++++-- appview/pulls/router.go | 2 ++ 2 file(s) changed, 6 insertion(s)(+), 2 deletion(s)(-) diff --git a/appview/pulls/pulls.go b/appview/pulls/pulls.go --- a/appview/pulls/pulls.go +++ b/appview/pulls/pulls.go @@ -2026,9 +2026,10 @@ } // auth filter: only owner or collaborators can close roles := f.RolesInRepo(user) + isOwner := roles.IsOwner() isCollaborator := roles.IsCollaborator() isPullAuthor := user.Did == pull.OwnerDid - isCloseAllowed := isCollaborator || isPullAuthor + isCloseAllowed := isOwner || isCollaborator || isPullAuthor if !isCloseAllowed { log.Println("failed to close pull") s.pages.Notice(w, "pull-close", "You are unauthorized to close this pull.") @@ -2094,9 +2095,10 @@ } // auth filter: only owner or collaborators can close roles := f.RolesInRepo(user) + isOwner := roles.IsOwner() isCollaborator := roles.IsCollaborator() isPullAuthor := user.Did == pull.OwnerDid - isCloseAllowed := isCollaborator || isPullAuthor + isCloseAllowed := isOwner || isCollaborator || isPullAuthor if !isCloseAllowed { log.Println("failed to close pull") s.pages.Notice(w, "pull-close", "You are unauthorized to close this pull.") diff --git a/appview/pulls/router.go b/appview/pulls/router.go --- a/appview/pulls/router.go +++ b/appview/pulls/router.go @@ -44,6 +44,8 @@ r.Route("/resubmit", func(r chi.Router) { r.Get("/", s.ResubmitPull) r.Post("/", s.ResubmitPull) }) + // permissions here require us to know pull author + // it is handled within the route r.Post("/close", s.ClosePull) r.Post("/reopen", s.ReopenPull) // collaborators only -- tangled.sh