Skip to content

fix: apply access filter to samples findOne - #2885

Merged
omkar-ethz merged 5 commits into
SciCatProject:masterfrom
knQzx:samples-findone-access-filter
Aug 20, 2026
Merged

omkar-ethz merged 5 commits into
SciCatProject:masterfrom
knQzx:samples-findone-access-filter

Conversation

@knQzx

@knQzx knQzx commented Aug 12, 2026 •

Copy link
Copy Markdown
Contributor

The samples findOne endpoint ran the caller's filter with only a class level read guard, so any authenticated user could read any sample by crafting the filter. This applies the same access filter the list endpoint uses.

Summary by Sourcery

Enforce sample access controls when retrieving individual samples.

Bug Fixes:

  • Apply the same access filtering to the samples findOne endpoint as to sample listing, preventing users from retrieving samples they are not authorized to access.

Tests:

  • Add authorization coverage for findOne access by sample owner, unauthorized users, and access-group members.

@knQzx
knQzx requested a review from a team as a code owner August 12, 2026 16:22

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've found 1 issue, and left some high level feedback:

  • Consider extracting the queryFilters parsing and updateFiltersForList application into a shared helper so the list and findOne endpoints stay consistently aligned when filter/access logic changes.
Prompt for AI Agents
Please address the comments from this code review:

## Overall Comments
- Consider extracting the `queryFilters` parsing and `updateFiltersForList` application into a shared helper so the list and findOne endpoints stay consistently aligned when filter/access logic changes.

## Individual Comments

### Comment 1
<location path="src/samples/samples.controller.ts" line_range="604-607" />
<code_context>
-    const jsonFilters: IFilters<SampleDocument, ISampleFields> = queryFilters
-      ? JSON.parse(queryFilters)
-      : {};
+    const jsonFilters: IFilters<SampleDocument, ISampleFields> =
+      this.updateFiltersForList(
+        request,
+        queryFilters ? JSON.parse(queryFilters) : {},
+      );
     const whereFilters = jsonFilters.where ?? {};
</code_context>
<issue_to_address>
**issue:** Consider handling malformed JSON in `queryFilters` to avoid unexpected runtime errors.

Because `queryFilters` comes from user input, any invalid JSON passed to `JSON.parse` will throw and can surface as a 500. Consider wrapping the parse in try/catch (or similar defensive parsing) so you can return a controlled client error (e.g., 400) instead of an uncaught exception.
</issue_to_address>

Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

Comment thread src/samples/samples.controller.ts Outdated
Comment on lines +604 to +607
const jsonFilters: IFilters<SampleDocument, ISampleFields> =
this.updateFiltersForList(
request,
queryFilters ? JSON.parse(queryFilters) : {},

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

issue: Consider handling malformed JSON in queryFilters to avoid unexpected runtime errors.

Because queryFilters comes from user input, any invalid JSON passed to JSON.parse will throw and can surface as a 500. Consider wrapping the parse in try/catch (or similar defensive parsing) so you can return a controlled client error (e.g., 400) instead of an uncaught exception.

@omkar-ethz omkar-ethz left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! added missing e2e tests for findOne (similar to the list endpoint)

@omkar-ethz
omkar-ethz enabled auto-merge (squash) August 20, 2026 09:23
@omkar-ethz
omkar-ethz merged commit 9f12530 into SciCatProject:master Aug 20, 2026
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants