Project data was readable by any signed-in user #8

New issue

Closed

opened 2026-10-14 23:16:17 -04:00 by vmanne-poc · 0 comments

vmanne-poc commented

2026-10-14 23:16:17 -04:00

Owner

Problem: routes under /projects/:projectId/... (contacts, senders, templates, campaigns, forms, reports) only checked that a user was logged in, not that they belonged to the project. Because self-registration was open, anyone could register and read or change another project's data.

Fix: ProjectAccessGuard runs after JWT auth on every project-scoped route and requires a ProjectMember row. Non-members get 404 so the API doesn't confirm a project exists. POSTAK_DISABLE_REGISTRATION=true can also turn off public sign-up.

Tests: guard unit tests; e2e test "hides a project from users who are not members".

Fixed in v0.7.0.

**Problem:** routes under `/projects/:projectId/...` (contacts, senders, templates, campaigns, forms, reports) only checked that a user was logged in, not that they belonged to the project. Because self-registration was open, anyone could register and read or change another project's data. **Fix:** `ProjectAccessGuard` runs after JWT auth on every project-scoped route and requires a `ProjectMember` row. Non-members get 404 so the API doesn't confirm a project exists. `POSTAK_DISABLE_REGISTRATION=true` can also turn off public sign-up. **Tests:** guard unit tests; e2e test "hides a project from users who are not members". Fixed in `v0.7.0`.

vmanne-poc added this to the Phase 7: Segmentation, access control & e2e tests (v0.7.0) milestone

2026-10-14 23:16:17 -04:00

vmanne-poc

2026-10-14 23:16:17 -04:00