fix(routes): gate content-analytics view/feedback writes by page access (#890) - #985
Merged
Merged
Conversation
…ss (#890) POST /pages/:id/feedback and /pages/:id/view wrote straight into article_feedback/page_views with no access check, so a missing page id raised a Postgres FK 23503 surfaced as HTTP 500 (an existence oracle) and any user could pollute admin analytics for pages they cannot read. Both handlers now call userCanAccessPage before touching the tables (mirroring the #733 hardening in comments.ts), returning a uniform 404 for missing/restricted/deleted pages. Covered by two new boundary-mocked route tests that fail before the gate (500/201) and pass after (404, no query). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Review follow-up on #985: the aggregate feedback read was left ungated, leaving the same existence/restricted-page oracle the PR closed for writes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
POST /pages/:id/feedbackandPOST /pages/:id/viewincontent-analytics.tswrote directly intoarticle_feedback/page_viewswith no page lookup or access check.userCanAccessPagebefore touching the tables, mirroring the Security: knowledge routes missing per-space/page authorization (IDOR) #733 hardening already applied tocomments.ts.Closes #890.
Root cause
The two POST write handlers never resolved the page or called
userCanAccessPage, so thepage_id NOT NULL REFERENCES pages(id)FK was the only (and wrong) line of defense — raising an unhandled 500 for missing ids and leaving restricted pages writable.Fix
userCanAccessPagefromrbac-service.if (!(await userCanAccessPage(userId, pageId))) return reply.notFound('Page not found');to the feedback handler (before the upsert) and the view handler (before the dedup SELECT).userCanAccessPagereturns false for missing, soft-deleted, and restricted pages alike, collapsing them into a uniform 404 that closes the FK-500 path and the oracle at once.Testing
content-analytics-routes.test.tswith two boundary-mocked gating tests (rbac-service mocked); fails before the fix (feedback 500, view 201, query invoked), passes after (404, no query call).cd backend && npx vitest run src/routes/knowledge/content-analytics-routes.test.ts(23 pass) - eslint (pass) - tsc --noEmit (pass)Generated with Claude Code