chore: update src/pages/api/repos/[owner]/[repo]/pulls/templates.ts
swadhinbiswas committed 8 months ago
c712762
1 parent 90f3dee
commit c712762
1 file changed
+5 -3
Showing 1 changed file+5-3
▼src/pages/api/repos/[owner]/[repo]/pulls/templates.ts
+5-3
| @@ -3,6 +3,7 @@ import { getDatabase, schema } from "@/db"; | ||
3 | 3 | import { and, eq } from "drizzle-orm"; |
4 | 4 | import { resolveRepoPath } from "@/lib/git-storage"; |
5 | 5 | import { getFileContent } from "@/lib/git"; |
6 | +import { canReadRepo } from "@/lib/permissions"; | |
6 | 7 | import { withErrorHandler } from "@/lib/errors"; |
7 | 8 | import { notFound, success } from "@/lib/api"; |
8 | 9 | |
| @@ -17,9 +18,6 @@ export const GET: APIRoute = withErrorHandler(async ({ params, request, locals } | ||
17 | 18 | |
18 | 19 | const db = getDatabase(); |
19 | 20 | |
20 | - // permissions check (read access) | |
21 | - // In a real app we should check this, but for now assuming public or implicit check via middleware/repo existence | |
22 | - // We'll do a quick check | |
23 | 21 | const user = await db.query.users.findFirst({ |
24 | 22 | where: eq(schema.users.username, ownerName), |
25 | 23 | }); |
| @@ -35,6 +33,10 @@ export const GET: APIRoute = withErrorHandler(async ({ params, request, locals } | ||
35 | 33 | |
36 | 34 | if (!repo) return notFound("Repository not found"); |
37 | 35 | |
36 | + if (!(await canReadRepo(locals.user?.id, repo, { isAdmin: locals.user?.isAdmin }))) { | |
37 | + return notFound("Repository not found"); | |
38 | + } | |
39 | + | |
38 | 40 | // Resolve path |
39 | 41 | const repoPath = await resolveRepoPath(repo.diskPath); |
40 | 42 | const targetBranch = branch || repo.defaultBranch; |
41 | 43 | |