fix: corriger l'IDOR sur update/delete (parole, artiste, commentaire)

src/api/artiste/routes/artiste.js

@@ -6,6 +6,12 @@ module.exports = createCoreRouter('api::artiste.artiste', {
   config: {
     create: {
       policies: ['global::is-payload-owner']
+    },
+    update: {
+      policies: [{name: 'global::is-document-owner', config: {uid: 'api::artiste.artiste'}}]
+    },
+    delete: {
+      policies: [{name: 'global::is-document-owner', config: {uid: 'api::artiste.artiste'}}]
     }
   }
 })

src/api/commentaire/routes/commentaire.js

@@ -6,6 +6,12 @@ module.exports = createCoreRouter('api::commentaire.commentaire', {
   config: {
     create: {
       policies: ['global::is-payload-owner']
+    },
+    update: {
+      policies: [{name: 'global::is-document-owner', config: {uid: 'api::commentaire.commentaire'}}]
+    },
+    delete: {
+      policies: [{name: 'global::is-document-owner', config: {uid: 'api::commentaire.commentaire'}}]
     }
   }
 })

src/api/parole/routes/parole.js

@@ -6,6 +6,12 @@ module.exports = createCoreRouter('api::parole.parole', {
   config: {
     create: {
       policies: ['global::is-payload-owner']
+    },
+    update: {
+      policies: [{name: 'global::is-document-owner', config: {uid: 'api::parole.parole'}}]
+    },
+    delete: {
+      policies: [{name: 'global::is-document-owner', config: {uid: 'api::parole.parole'}}]
     }
   }
 })

src/policies/__tests__/is-document-owner.test.js

@@ -0,0 +1,73 @@
+import {describe, it, expect, vi} from 'vitest'
+
+const {default: isDocumentOwner} = await import('../is-document-owner.js')
+
+function buildStrapi({jwtUserId, document}) {
+  const dbQuery = {
+    findOne: vi.fn(async () => document)
+  }
+
+  return {
+    plugins: {
+      'users-permissions': {
+        services: {
+          jwt: {
+            getToken: vi.fn(async () => ({id: jwtUserId}))
+          }
+        }
+      }
+    },
+    db: {
+      query: vi.fn(() => dbQuery)
+    },
+    dbQuery
+  }
+}
+
+function buildPolicyContext({authorization = 'Bearer faketoken', paramId, bodyDocumentId} = {}) {
+  return {
+    params: paramId ? {id: paramId} : {},
+    request: {
+      header: authorization ? {authorization} : {},
+      body: {data: {documentId: bodyDocumentId}}
+    }
+  }
+}
+
+describe('is-document-owner policy', () => {
+  it("refuse quand aucun en-tête d'autorisation n'est présent", async () => {
+    const strapi = buildStrapi({jwtUserId: 1, document: {documentId: 'doc-1', user: {id: 1}}})
+    const policyContext = buildPolicyContext({authorization: null, paramId: 'doc-1'})
+
+    await expect(isDocumentOwner(policyContext, {uid: 'api::parole.parole'}, {strapi})).rejects.toThrow('Opération non autorisée')
+  })
+
+  it('autorise quand le user du JWT est le propriétaire du document (id dans les params)', async () => {
+    const strapi = buildStrapi({jwtUserId: 1, document: {documentId: 'doc-1', user: {id: 1}}})
+    const policyContext = buildPolicyContext({paramId: 'doc-1'})
+
+    await expect(isDocumentOwner(policyContext, {uid: 'api::parole.parole'}, {strapi})).resolves.toBe(true)
+    expect(strapi.dbQuery.findOne).toHaveBeenCalledWith({where: {documentId: 'doc-1'}, populate: {user: true}})
+  })
+
+  it('autorise quand le documentId vient du corps de la requête (cas du contrôleur parole.update)', async () => {
+    const strapi = buildStrapi({jwtUserId: 1, document: {documentId: 'doc-1', user: {id: 1}}})
+    const policyContext = buildPolicyContext({bodyDocumentId: 'doc-1'})
+
+    await expect(isDocumentOwner(policyContext, {uid: 'api::parole.parole'}, {strapi})).resolves.toBe(true)
+  })
+
+  it("refuse quand le user du JWT n'est pas le propriétaire du document", async () => {
+    const strapi = buildStrapi({jwtUserId: 999, document: {documentId: 'doc-1', user: {id: 1}}})
+    const policyContext = buildPolicyContext({paramId: 'doc-1'})
+
+    await expect(isDocumentOwner(policyContext, {uid: 'api::parole.parole'}, {strapi})).rejects.toThrow('Opération non autorisée')
+  })
+
+  it("refuse quand le document ciblé n'existe pas", async () => {
+    const strapi = buildStrapi({jwtUserId: 1, document: null})
+    const policyContext = buildPolicyContext({paramId: 'doc-inconnu'})
+
+    await expect(isDocumentOwner(policyContext, {uid: 'api::parole.parole'}, {strapi})).rejects.toThrow('Ressource introuvable.')
+  })
+})

src/policies/is-document-owner.js

@@ -0,0 +1,35 @@
+'use strict';
+
+const { UnauthorizedError, NotFoundError } = require('@strapi/utils').errors
+
+module.exports = async (policyContext, config, {strapi}) => {
+  const {request, params} = policyContext
+
+  if (!request?.header?.authorization) {
+    throw new UnauthorizedError('Opération non autorisée')
+  }
+
+  let jwtUserId
+  try {
+    ({id: jwtUserId} = await strapi.plugins['users-permissions'].services.jwt.getToken(policyContext))
+  } catch (err) {
+    throw new UnauthorizedError('Opération non autorisée')
+  }
+
+  const documentId = params?.id ?? request.body?.data?.documentId
+
+  const document = await strapi.db.query(config.uid).findOne({
+    where: {documentId},
+    populate: {user: true}
+  })
+
+  if (!document) {
+    throw new NotFoundError('Ressource introuvable.')
+  }
+
+  if (document.user?.id !== jwtUserId) {
+    throw new UnauthorizedError('Opération non autorisée')
+  }
+
+  return true
+}