fix(trustlab): validate roles for user access

Author: kilemensi

apps/trustlab/src/payload/access/abilities.js

@@ -41,14 +41,17 @@ export const hasAdminAccess = ({ req } = {}) => isAdmin(req?.user);
 
 // TODO(@kelvinkipruto): what happens on delete? cascade or not?
 export const canManageUser = (user) => {
-  if (!user) {
+  if (!isLoggedIn(user)) {
     return false;
   }
   // Admins can manage all users
   if (user.role === ROLE_ADMIN) {
     return true;
   }
   // All other users can manage their own accounts
+  if (!user.id) {
+    return false;
+  }
   const orQuery = [
     {
       id: {

apps/trustlab/src/payload/access/index.test.js

@@ -121,10 +121,22 @@ describe("payload.access", () => {
       });
     });
 
-    it("denies requests from anonymous users", () => {
+    it("denies requests from invalid-role and anonymous users", () => {
+      expect(
+        hasManageUserAccess({ req: { user: { id: 1, role: "unknown" } } }),
+      ).toBe(false);
       expect(hasManageUserAccess({ req: {} })).toBe(false);
       expect(hasManageUserAccess(undefined)).toBe(false);
     });
+
+    it("denies requests from non-admin users without a user id for ownership checks", () => {
+      expect(
+        hasManageUserAccess({ req: { user: { role: ROLE_AUTHOR } } }),
+      ).toBe(false);
+      expect(
+        hasManageUserAccess({ req: { user: { role: ROLE_EDITOR } } }),
+      ).toBe(false);
+    });
   });
 
   describe("abilities.hasEditorAccess", () => {