From 6e8a0d731468cf0f399b97e7bd53fbd6a2394e8f Mon Sep 17 00:00:00 2001 From: Trevor Buckner Date: Wed, 18 Dec 2024 17:07:09 -0500 Subject: [PATCH] current user owns 0-author brew only if edit mode Previous code was treating /share/ visits to google brews with no stub as visits by owner, thus using their own credentials to open the file instead of serviceaccount --- server/homebrew.api.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/server/homebrew.api.js b/server/homebrew.api.js index 56da8872c..548346643 100644 --- a/server/homebrew.api.js +++ b/server/homebrew.api.js @@ -106,7 +106,7 @@ const api = { stub = stub?.toObject(); googleId ??= stub?.googleId; - const isOwner = !stub || stub?.authors?.length === 0 || stub?.authors?.[0] === req.account?.username; + const isOwner = (accessType == 'edit' && (!stub || stub?.authors?.length === 0)) || stub?.authors?.[0] === req.account?.username; const isAuthor = stub?.authors?.includes(req.account?.username); const isInvited = stub?.invitedAuthors?.includes(req.account?.username); @@ -124,7 +124,7 @@ const api = { // If there is a google id, try to find the google brew if(!stubOnly && googleId) { - const oAuth2Client = isOwner? GoogleActions.authCheck(req.account, res) : undefined; + const oAuth2Client = isOwner ? GoogleActions.authCheck(req.account, res) : undefined; const googleBrew = await GoogleActions.getGoogleBrew(oAuth2Client, googleId, id, accessType) .catch((googleError)=>{