fix(time): enforce user_id ownership on time-entry stop/update/delete

David commented

2026-06-13 07:34:15 +02:00

Owner

The stop_timer, update_time_entry, and delete_time_entry routes scoped writes by tenant_id and id only, letting any user in a tenant stop, tamper with, or delete a colleague's timer or entry (same-tenant IDOR). The routes now derive an owner guard of Some(user.id) for non-admins and None for admins, threaded into each service call. The SQL predicate AND ($N::uuid IS NULL OR user_id = $N) skips the check for admins (None) and otherwise restricts the write to rows the caller owns, so a non-owner gets the existing not-found path rather than mutating another user's row.

#MAPPS-136

The stop_timer, update_time_entry, and delete_time_entry routes scoped writes by tenant_id and id only, letting any user in a tenant stop, tamper with, or delete a colleague's timer or entry (same-tenant IDOR). The routes now derive an owner guard of Some(user.id) for non-admins and None for admins, threaded into each service call. The SQL predicate AND ($N::uuid IS NULL OR user_id = $N) skips the check for admins (None) and otherwise restricts the write to rows the caller owns, so a non-owner gets the existing not-found path rather than mutating another user's row. #MAPPS-136

David added 1 commit

2026-06-13 07:34:15 +02:00

fix(time): enforce user_id ownership on time-entry stop/update/delete

Check / clippy + fmt + tests (pull_request) Successful in 51s

Details

b2971c467d

The stop_timer, update_time_entry, and delete_time_entry routes scoped writes by tenant_id and id only, letting any user in a tenant stop, tamper with, or delete a colleague's timer or entry (same-tenant IDOR). The routes now derive an owner guard of Some(user.id) for non-admins and None for admins, threaded into each service call. The SQL predicate AND ($N::uuid IS NULL OR user_id = $N) skips the check for admins (None) and otherwise restricts the write to rows the caller owns, so a non-owner gets the existing not-found path rather than mutating another user's row.

#MAPPS-136

David added 1 commit

2026-06-13 13:39:16 +02:00

Merge branch 'main' into fix/mapps-136-time-entry-ownership-guard

Create release / Create release from merged PR (pull_request) Has been skipped

Details

Check / clippy + fmt + tests (pull_request) Successful in 57s

Details

f907232751