ee9f5c1a4d
`require_can_edit` matched `Some(owner) != caller → Forbidden` but let `None` through. Every crawler row (`repo::crawler::upsert_manga`) has NULL `uploaded_by`, so any signed-in user could PATCH /api/v1/mangas/<id> and rewrite the catalog — `update`, `put_cover`, and `delete_cover` were all in scope. With self-registration on by default, the path was: register → mass-edit catalog + delete cover blobs from storage. The original carve-out at the comment said "Once an admin role lands the NULL case can flip to admin-only." The admin role landed in migration 0018; flipping it now. New rule: * `Some(owner)` and owner == caller → ok (unchanged) * `Some(_)` and caller is admin → ok (admin moderation) * `Some(_)` otherwise → 403 (unchanged) * `None` and caller is admin → ok (NEW — operator can curate) * `None` otherwise → 403 (was: ok — the bug) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
33 lines
862 B
JSON
33 lines
862 B
JSON
{
|
|
"name": "mangalord-frontend",
|
|
"version": "0.87.3",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite dev",
|
|
"build": "vite build",
|
|
"preview": "vite preview",
|
|
"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"test:e2e": "playwright test"
|
|
},
|
|
"devDependencies": {
|
|
"@lucide/svelte": "^1.16.0",
|
|
"@playwright/test": "^1.48.0",
|
|
"@sveltejs/adapter-node": "^5.2.0",
|
|
"@sveltejs/kit": "^2.7.0",
|
|
"@sveltejs/vite-plugin-svelte": "^4.0.0",
|
|
"@testing-library/jest-dom": "^6.6.0",
|
|
"@testing-library/svelte": "^5.2.0",
|
|
"@types/node": "^22.7.0",
|
|
"jsdom": "^25.0.0",
|
|
"svelte": "^5.0.0",
|
|
"svelte-check": "^4.0.0",
|
|
"tslib": "^2.7.0",
|
|
"typescript": "^5.6.0",
|
|
"vite": "^5.4.0",
|
|
"vitest": "^2.1.0"
|
|
}
|
|
}
|