7a1dca378f
Ownership was checked ad hoc: some handlers loaded-and-compared ownerId, some lib mutators enforced it in WHERE clauses and silently no-op'd for non-owners, and nothing tied the two together. Two real authorization bugs hid in the gaps: linkActivityToRoute ignored its ownerId parameter entirely (any logged-in user could relink any activity), and createRouteFromActivity loaded any activity without an ownership check (a non-owner could copy a private activity's GPX into their own route). PUT /api/v1/routes/:id also returned ok:true for non-owners without updating anything. ownership.server.ts is now the single enforcement point: - loadOwnedRoute / loadOwnedActivity (non-throwing, for callers with their own error vocabulary) and requireOwnedRoute / requireOwnedActivity (throwing data() 404/403 for web handlers; 404 by default so guessed ids don't leak existence) - the returned entities carry an Owned<> brand; mutators (updateRoute, deleteRoute, deleteActivity, updateActivityVisibility, linkActivityToRoute, createRouteFromActivity) now require an OwnedRef, so skipping the check is a compile error - vouchOwnership is the explicit, greppable escape hatch for the one non-session authorization path (the Planner JWT callback) - WHERE ownerId clauses stay in the mutators as defense in depth Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
43 lines
1.6 KiB
TypeScript
43 lines
1.6 KiB
TypeScript
import type { Route } from "./+types/api.v1.activities.$id";
|
|
import { requireApiUser, apiError } from "~/lib/api-guard.server";
|
|
import { getActivity, deleteActivity } from "~/lib/activities.server";
|
|
import { loadOwnedActivity } from "~/lib/ownership.server";
|
|
import { ERROR_CODES } from "@trails-cool/api";
|
|
|
|
/** GET /api/v1/activities/:id — full activity detail */
|
|
export async function loader({ request, params }: Route.LoaderArgs) {
|
|
const user = await requireApiUser(request);
|
|
const activity = await getActivity(params.id);
|
|
|
|
if (!activity || activity.ownerId !== user.id) {
|
|
return apiError(404, ERROR_CODES.NOT_FOUND, "Activity not found");
|
|
}
|
|
|
|
return Response.json({
|
|
id: activity.id,
|
|
name: activity.name,
|
|
description: activity.description,
|
|
routeId: activity.routeId,
|
|
distance: activity.distance,
|
|
duration: activity.duration,
|
|
elevationGain: activity.elevationGain,
|
|
elevationLoss: activity.elevationLoss,
|
|
startedAt: activity.startedAt?.toISOString() ?? null,
|
|
gpx: activity.gpx,
|
|
geojson: activity.geojson,
|
|
createdAt: activity.createdAt.toISOString(),
|
|
});
|
|
}
|
|
|
|
/** DELETE /api/v1/activities/:id */
|
|
export async function action({ request, params }: Route.ActionArgs) {
|
|
if (request.method !== "DELETE") return new Response(null, { status: 405 });
|
|
const user = await requireApiUser(request);
|
|
|
|
const result = await loadOwnedActivity(params.id, user.id);
|
|
if (!result.ok) {
|
|
return apiError(404, ERROR_CODES.NOT_FOUND, "Activity not found");
|
|
}
|
|
await deleteActivity(result.entity);
|
|
return new Response(null, { status: 204 });
|
|
}
|