Skip to content

Commit

Permalink
current user owns 0-author brew only if edit mode
Browse files Browse the repository at this point in the history
Previous code was treating /share/ visits to google brews with no stub as visits by owner, thus using their own credentials to open the file instead of serviceaccount
  • Loading branch information
calculuschild committed Dec 18, 2024
1 parent e61144b commit 6e8a0d7
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions server/homebrew.api.js
Original file line number Diff line number Diff line change
Expand Up @@ -106,7 +106,7 @@ const api = {
stub = stub?.toObject();
googleId ??= stub?.googleId;

const isOwner = !stub || stub?.authors?.length === 0 || stub?.authors?.[0] === req.account?.username;
const isOwner = (accessType == 'edit' && (!stub || stub?.authors?.length === 0)) || stub?.authors?.[0] === req.account?.username;
const isAuthor = stub?.authors?.includes(req.account?.username);
const isInvited = stub?.invitedAuthors?.includes(req.account?.username);

Expand All @@ -124,7 +124,7 @@ const api = {

// If there is a google id, try to find the google brew
if(!stubOnly && googleId) {
const oAuth2Client = isOwner? GoogleActions.authCheck(req.account, res) : undefined;
const oAuth2Client = isOwner ? GoogleActions.authCheck(req.account, res) : undefined;

const googleBrew = await GoogleActions.getGoogleBrew(oAuth2Client, googleId, id, accessType)
.catch((googleError)=>{
Expand Down

0 comments on commit 6e8a0d7

Please sign in to comment.