What doesn't work?
PUT /room is expected to support updating either a single room object or an array of room update objects.
The service and room authorization rule both appear to support arrays, but the request fails when sent through the actual HTTP endpoint, for example from Postman. The response is a 403 error:
The logged-in user has no permission to execute update_request action
The likely bug is in AuthorizationInterceptor. For update requests it does:
plainToInstance(subject, request.body)
When request.body is a top-level array, this returns an array of UpdateRoomDto instances. CASL then checks permission against the array itself, whose subject type is Array, not UpdateRoomDto. Because the ability rule grants update_request for UpdateRoomDto, the check fails even though the user has permission to edit the rooms.
There is likely a second issue in the same update block: after the permission check, the interceptor does:
request.body = pick(dataClass, allowedFields)
For an array payload, this does not preserve the array of update objects correctly.
The existing tests do not catch this because they appear to test RoomService.updateSoulHomeRooms() directly and/or roomRules() directly, but not the full HTTP request path through AuthorizationInterceptor.
What is the endpoint and method?
Endpoint: /room
Method: PUT
How can it be reproduced?
-
Log in as a user who belongs to the same clan as the rooms being updated and has room edit permissions.
-
Send a PUT /room request with a top-level JSON array body, for example:
[
{
"_id": "ROOM_ID_1",
"floorType": "wood"
},
{
"_id": "ROOM_ID_2",
"wallpaper": "painted"
}
]
-
Observe that the request fails with 403 Forbidden.
-
The response message is:
The logged-in user has no permission to execute update_request action
Sending a single room update object does work, which indicates the failure is specific to the top-level array payload passing through the authorization interceptor.
What doesn't work?
PUT /roomis expected to support updating either a single room object or an array of room update objects.The service and room authorization rule both appear to support arrays, but the request fails when sent through the actual HTTP endpoint, for example from Postman. The response is a 403 error:
The logged-in user has no permission to execute update_request actionThe likely bug is in
AuthorizationInterceptor. For update requests it does:plainToInstance(subject, request.body)When
request.bodyis a top-level array, this returns an array ofUpdateRoomDtoinstances. CASL then checks permission against the array itself, whose subject type isArray, notUpdateRoomDto. Because the ability rule grantsupdate_requestforUpdateRoomDto, the check fails even though the user has permission to edit the rooms.There is likely a second issue in the same update block: after the permission check, the interceptor does:
request.body = pick(dataClass, allowedFields)For an array payload, this does not preserve the array of update objects correctly.
The existing tests do not catch this because they appear to test
RoomService.updateSoulHomeRooms()directly and/orroomRules()directly, but not the full HTTP request path throughAuthorizationInterceptor.What is the endpoint and method?
Endpoint:
/roomMethod:
PUTHow can it be reproduced?
Log in as a user who belongs to the same clan as the rooms being updated and has room edit permissions.
Send a
PUT /roomrequest with a top-level JSON array body, for example:[ { "_id": "ROOM_ID_1", "floorType": "wood" }, { "_id": "ROOM_ID_2", "wallpaper": "painted" } ]Observe that the request fails with
403 Forbidden.The response message is:
Sending a single room update object does work, which indicates the failure is specific to the top-level array payload passing through the authorization interceptor.