sinvo/docmost
1
0
Fork 0
mirror of https://github.com/docmost/docmost.git synced 2026-08-30 18:36:26 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: scope comment endpoints to workspace and skip trashed pages

Browse Source
This commit is contained in:
Philipinho
2026-08-24 20:19:43 +01:00
parent dae22d5a42
commit ff28a38c88
1 changed files with 11 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/server/src/core/comment/comment.controller.ts
+11 -6
View File
@@ -54,7 +54,7 @@ export class CommentController {
@AuthWorkspace() workspace: Workspace, @AuthWorkspace() workspace: Workspace,
) { ) {
const page = await this.pageRepo.findById(createCommentDto.pageId); const page = await this.pageRepo.findById(createCommentDto.pageId);
if (!page || page.deletedAt) { if (!page || page.workspaceId !== workspace.id || page.deletedAt) {
throw new NotFoundException('Page not found'); throw new NotFoundException('Page not found');
} }
@@ -89,9 +89,10 @@ export class CommentController {
@Body() @Body()
pagination: PaginationOptions, pagination: PaginationOptions,
@AuthUser() user: User, @AuthUser() user: User,
@AuthWorkspace() workspace: Workspace,
) { ) {
const page = await this.pageRepo.findById(input.pageId); const page = await this.pageRepo.findById(input.pageId);
if (!page) { if (!page || page.workspaceId !== workspace.id || page.deletedAt) {
throw new NotFoundException('Page not found'); throw new NotFoundException('Page not found');
} }
@@ -102,14 +103,18 @@ export class CommentController {
@HttpCode(HttpStatus.OK) @HttpCode(HttpStatus.OK)
@Post('info') @Post('info')
async findOne(@Body() input: CommentIdDto, @AuthUser() user: User) { async findOne(
@Body() input: CommentIdDto,
@AuthUser() user: User,
@AuthWorkspace() workspace: Workspace,
) {
const comment = await this.commentRepo.findById(input.commentId); const comment = await this.commentRepo.findById(input.commentId);
if (!comment) { if (!comment) {
throw new NotFoundException('Comment not found'); throw new NotFoundException('Comment not found');
} }
const page = await this.pageRepo.findById(comment.pageId); const page = await this.pageRepo.findById(comment.pageId);
if (!page) { if (!page || page.workspaceId !== workspace.id || page.deletedAt) {
throw new NotFoundException('Page not found'); throw new NotFoundException('Page not found');
} }
@@ -130,7 +135,7 @@ export class CommentController {
} }
const page = await this.pageRepo.findById(comment.pageId); const page = await this.pageRepo.findById(comment.pageId);
if (!page) { if (!page || page.workspaceId !== workspace.id || page.deletedAt) {
throw new NotFoundException('Page not found'); throw new NotFoundException('Page not found');
} }
@@ -148,7 +153,7 @@ export class CommentController {
} }
const page = await this.pageRepo.findById(comment.pageId); const page = await this.pageRepo.findById(comment.pageId);
if (!page) { if (!page || page.workspaceId !== workspace.id || page.deletedAt) {
throw new NotFoundException('Page not found'); throw new NotFoundException('Page not found');
} }