stwaidele/dorfteich
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 22 Wiki Activity

#135 Fix: /read-Route deklariert Zugriffsregel explizit (@AuthenticatedOnly)
Some checks failed
CI / Lint, typecheck, test (pull_request) Failing after 4m20s
Details
CI / Auth e2e pack (pull_request) Has been skipped
Details
CI / Import/export fidelity gate (pull_request) Has been skipped
Details
CI / Build container images (pull_request) Has been skipped
Details

Browse Source 
route-permissions.e2e.db.test.ts (#52) verlangt, dass JEDE Route ihre
Zugriffsregel explizit deklariert (PERMISSION_KEY, @Public oder
SiteAdminGuard). Der neue GET /read/:pond/:slug hatte keinen Decorator
(verließ sich auf den Default-Guard) → Coverage-Test rot in CI.
@AuthenticatedOnly() ergänzt (Session erforderlich; per-Page-Recht prüft
weiterhin der Service via resolve→canAccessPage→404).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0155v2aT8AG1kZDQEZiCLBWC
This commit is contained in:
Claude Fable 5 2026-07-19 06:01:45 +02:00
parent c164a031e4
commit d5b895ada2
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
apps/api/src/public/read-content.controller.ts
View File

@ -1,6 +1,7 @@
import { Controller, Get, Param, Req } from '@nestjs/common'; import { Controller, Get, Param, Req } from '@nestjs/common';
import { AuthedRequest } from '../auth/auth.guard'; import { AuthedRequest } from '../auth/auth.guard';
import { AuthenticatedOnly } from '../permissions/permission.decorators';
import { PublicPageContent, PublicService } from './public.service'; import { PublicPageContent, PublicService } from './public.service';
/** /**
@ -16,7 +17,10 @@ import { PublicPageContent, PublicService } from './public.service';
export class ReadContentController { export class ReadContentController {
constructor(private readonly publicPages: PublicService) {} constructor(private readonly publicPages: PublicService) {}
// Session required (explicit access rule, issue #52); per-page read
// permission is enforced in the service (resolve → canAccessPage → 404).
@Get(':pondSlug/:pageSlug') @Get(':pondSlug/:pageSlug')
@AuthenticatedOnly()
async content( async content(
@Param('pondSlug') pondSlug: string, @Param('pondSlug') pondSlug: string,
@Param('pageSlug') pageSlug: string, @Param('pageSlug') pageSlug: string,