admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

case 4712 - customer contacts work only with their own service requests and units

Browse Source 
Step 3 of 4712 (security review F14). The Customer role has change rights on
service requests and nothing checked whose they were. For customer contacts:
another customer's request is not found (read, update, delete); creating or
moving a request to a customer the contact does not own is refused (403); a
contact's request is always requested by that contact. unit/customerunit adds
units only to the contact's own customer (or one of its head office's).

Checked: another customer's request 404 (was 200), create for another customer
403, own request created and deleted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-24 14:02:19 -07:00
parent bd4494abac
commit d75c3eecea
4 changed files with 41 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
server/AyaNova/Controllers/CustomerServiceRequestController.cs
View File

@@ -1,6 +1,8 @@
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using Microsoft.EntityFrameworkCore;
using Microsoft.AspNetCore.Routing;
using Microsoft.AspNetCore.Authorization;
using Microsoft.Extensions.Logging;
@@ -52,6 +54,12 @@ namespace AyaNova.Api.Controllers
return StatusCode(403, new ApiNotAuthorizedResponse());
if (!ModelState.IsValid)
return BadRequest(new ApiErrorResponse(ModelState));
if (!await ContactMayUseCustomerAsync(newObject.CustomerId))
return StatusCode(403, new ApiNotAuthorizedResponse());
//case 4712: a contact's request is always requested by that contact
var userType = UserTypeFromContext.Type(HttpContext.Items);
if (userType == UserType.Customer || userType == UserType.HeadOffice)
newObject.RequestedByUserId = UserIdFromContext.Id(HttpContext.Items);
CustomerServiceRequest o = await biz.CreateAsync(newObject);
if (o == null)
return BadRequest(new ApiErrorResponse(biz.Errors));
@@ -76,6 +84,8 @@ namespace AyaNova.Api.Controllers
return StatusCode(403, new ApiNotAuthorizedResponse());
if (!ModelState.IsValid)
return BadRequest(new ApiErrorResponse(ModelState));
if (!await ContactMayUseExistingAsync(id))
return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
var o = await biz.GetAsync(id);
if (o == null) return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
return Ok(ApiOkResponse.Response(o));
@@ -96,7 +106,11 @@ namespace AyaNova.Api.Controllers
CustomerServiceRequestBiz biz = CustomerServiceRequestBiz.GetBiz(ct, HttpContext);
if (!Authorized.HasModifyRole(HttpContext.Items, biz.BizType))
return StatusCode(403, new ApiNotAuthorizedResponse());
var o = await biz.PutAsync(updatedObject);
if (!await ContactMayUseExistingAsync(updatedObject.Id))
return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
if (!await ContactMayUseCustomerAsync(updatedObject.CustomerId))
return StatusCode(403, new ApiNotAuthorizedResponse());
var o = await biz.PutAsync(updatedObject);
if (o == null)
{
if (biz.Errors.Exists(z => z.Code == ApiErrorCode.CONCURRENCY_CONFLICT))
@@ -122,11 +136,32 @@ namespace AyaNova.Api.Controllers
CustomerServiceRequestBiz biz = CustomerServiceRequestBiz.GetBiz(ct, HttpContext);
if (!Authorized.HasDeleteRole(HttpContext.Items, biz.BizType))
return StatusCode(403, new ApiNotAuthorizedResponse());
if (!await ContactMayUseExistingAsync(id))
return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
if (!await biz.DeleteAsync(id))
return BadRequest(new ApiErrorResponse(biz.Errors));
return NoContent();
}
//case 4712: a customer contact works only with its own customer's service requests (staff: always true)
private async Task<bool> ContactMayUseCustomerAsync(long customerId)
{
var userType = UserTypeFromContext.Type(HttpContext.Items);
if (userType != UserType.Customer && userType != UserType.HeadOffice)
return true;
return await UserBiz.CustomerContactOwnsCustomerAsync(ct, UserIdFromContext.Id(HttpContext.Items), customerId);
}
//case 4712: same for an existing service request (true if it does not exist, so the normal not found applies)
private async Task<bool> ContactMayUseExistingAsync(long id)
{
var userType = UserTypeFromContext.Type(HttpContext.Items);
if (userType != UserType.Customer && userType != UserType.HeadOffice)
return true;
var customerId = await ct.CustomerServiceRequest.AsNoTracking().Where(z => z.Id == id).Select(z => (long?)z.CustomerId).FirstOrDefaultAsync();
return customerId == null || await UserBiz.CustomerContactOwnsCustomerAsync(ct, UserIdFromContext.Id(HttpContext.Items), (long)customerId);
}

3
server/AyaNova/Controllers/UnitController.cs
View File

@@ -80,6 +80,9 @@ namespace AyaNova.Api.Controllers
if (!ModelState.IsValid)
return BadRequest(new ApiErrorResponse(ModelState));
//case 4712: a contact adds units only to its own customer (or, head office contact, one of its customers)
if (!await UserBiz.CustomerContactOwnsCustomerAsync(ct, biz.UserId, newObject.CustomerId))
return StatusCode(403, new ApiNotAuthorizedResponse());
long? o = await biz.CustomerCreateAsync(newObject);
if (o == null)
return BadRequest(new ApiErrorResponse(biz.Errors));