diff --git a/backend/src/oauth/provider/genericOidc.provider.ts b/backend/src/oauth/provider/genericOidc.provider.ts index 10f957ae..e1f211d1 100644 --- a/backend/src/oauth/provider/genericOidc.provider.ts +++ b/backend/src/oauth/provider/genericOidc.provider.ts @@ -133,9 +133,9 @@ export abstract class GenericOidcProvider implements OAuthProvider { : idTokenData.preferred_username || idTokenData.name || idTokenData.nickname; - + let isAdmin: boolean; - + if (roleConfig?.path) { // A path to read roles from the token is configured let roles: string[] | null; @@ -146,9 +146,14 @@ export abstract class GenericOidcProvider implements OAuthProvider { } if (Array.isArray(roles)) { // Roles are found in the token - if (roleConfig.generalAccess && !roles.includes(roleConfig.generalAccess)) { + if ( + roleConfig.generalAccess && + !roles.includes(roleConfig.generalAccess) + ) { // Role for general access is configured and the user does not have it - this.logger.error(`User roles ${roles} do not include ${roleConfig.generalAccess}`); + this.logger.error( + `User roles ${roles} do not include ${roleConfig.generalAccess}`, + ); throw new ErrorPageException("user_not_allowed"); } if (roleConfig.adminAccess) { diff --git a/backend/src/oauth/provider/oidc.provider.ts b/backend/src/oauth/provider/oidc.provider.ts index 9265254c..09ac5a04 100644 --- a/backend/src/oauth/provider/oidc.provider.ts +++ b/backend/src/oauth/provider/oidc.provider.ts @@ -35,8 +35,10 @@ export class OidcProvider extends GenericOidcProvider { ): Promise { const claim = this.config.get("oauth.oidc-usernameClaim") || undefined; const rolePath = this.config.get("oauth.oidc-rolePath") || undefined; - const roleGeneralAccess = this.config.get("oauth.oidc-roleGeneralAccess") || undefined; - const roleAdminAccess = this.config.get("oauth.oidc-roleAdminAccess") || undefined; + const roleGeneralAccess = + this.config.get("oauth.oidc-roleGeneralAccess") || undefined; + const roleAdminAccess = + this.config.get("oauth.oidc-roleAdminAccess") || undefined; return super.getUserInfo(token, query, claim, { path: rolePath, generalAccess: roleGeneralAccess, diff --git a/backend/src/share/guard/shareSecurity.guard.ts b/backend/src/share/guard/shareSecurity.guard.ts index 24e9dd12..106702ba 100644 --- a/backend/src/share/guard/shareSecurity.guard.ts +++ b/backend/src/share/guard/shareSecurity.guard.ts @@ -63,9 +63,12 @@ export class ShareSecurityGuard extends JwtGuard { const user = request.user as User; // Only the creator and reverse share creator can access the reverse share if it's not public - if (share.reverseShare && !share.reverseShare.publicAccess - && share.creatorId !== user?.id - && share.reverseShare.creatorId !== user?.id) + if ( + share.reverseShare && + !share.reverseShare.publicAccess && + share.creatorId !== user?.id && + share.reverseShare.creatorId !== user?.id + ) throw new ForbiddenException( "Only reverse share creator can access this share", "private_share",