From d5b895ada2bc6797144457cc539ef59995785e1c Mon Sep 17 00:00:00 2001 From: Claude Fable 5 Date: Sun, 19 Jul 2026 06:01:45 +0200 Subject: [PATCH] #135 Fix: /read-Route deklariert Zugriffsregel explizit (@AuthenticatedOnly) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit route-permissions.e2e.db.test.ts (#52) verlangt, dass JEDE Route ihre Zugriffsregel explizit deklariert (PERMISSION_KEY, @Public oder SiteAdminGuard). Der neue GET /read/:pond/:slug hatte keinen Decorator (verließ sich auf den Default-Guard) → Coverage-Test rot in CI. @AuthenticatedOnly() ergänzt (Session erforderlich; per-Page-Recht prüft weiterhin der Service via resolve→canAccessPage→404). Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_0155v2aT8AG1kZDQEZiCLBWC --- apps/api/src/public/read-content.controller.ts | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/apps/api/src/public/read-content.controller.ts b/apps/api/src/public/read-content.controller.ts index f827af6..902417d 100644 --- a/apps/api/src/public/read-content.controller.ts +++ b/apps/api/src/public/read-content.controller.ts @@ -1,6 +1,7 @@ import { Controller, Get, Param, Req } from '@nestjs/common'; import { AuthedRequest } from '../auth/auth.guard'; +import { AuthenticatedOnly } from '../permissions/permission.decorators'; import { PublicPageContent, PublicService } from './public.service'; /** @@ -16,7 +17,10 @@ import { PublicPageContent, PublicService } from './public.service'; export class ReadContentController { constructor(private readonly publicPages: PublicService) {} + // Session required (explicit access rule, issue #52); per-page read + // permission is enforced in the service (resolve → canAccessPage → 404). @Get(':pondSlug/:pageSlug') + @AuthenticatedOnly() async content( @Param('pondSlug') pondSlug: string, @Param('pageSlug') pageSlug: string,