checking permissions

- block anonymous writes to wikis and both reads and writes to admin

Author: Arlen22

packages/mws/src/RequestState.ts

@@ -59,11 +59,14 @@ export class StateObject<
   }
 
   okUser() {
-    if (!this.user.isLoggedIn) throw "User not authenticated";
+    if (!this.user.isLoggedIn)
+      throw new SendError("ACCESS_DENIED", 403, { reason:  "User not authenticated" })
   }
   okAdmin() {
-    if (!this.user.isLoggedIn) throw "User not authenticated";
-    if (!this.user.isAdmin) throw "User is not an admin";
+    if (!this.user.isLoggedIn) 
+      throw new SendError("ACCESS_DENIED", 403, { reason:  "User not authenticated" })
+    if (!this.user.isAdmin) 
+      throw new SendError("ACCESS_DENIED", 403, { reason:  "User is not an admin" })
   }
 
   async $transaction<T>(fn: (prisma: PrismaTxnClient) => Promise<T>): Promise<T> {
@@ -78,30 +81,20 @@ export class StateObject<
     return this.engine.$transaction(arg(this.engine), options);
   }
 
-  makeTiddlerEtag(options: { bag_name: string; revision_id: string | number; }) {
-    // why do we need revision_id AND bag_name? revision_id is unique across all tiddlers
-    if (options.bag_name && options.revision_id) {
-      return `"tiddler:${options.bag_name}/${options.revision_id}"`;
-    } else {
-      throw "Missing bag_name or revision_id";
-    }
-  }
-
-
   assertWikiReferer(recipe_slug: string) {
     const state = this;
     if (!state.headers.referer) return;
     const referer = new URL(state.headers.referer);
     // console.log("Referer", state.headers.referer, referer);
     if (!referer.pathname.startsWith(state.pathPrefix))
-      throw state.sendEmpty(404, { "x-reason": "invalid path prefix" });
+      throw new SendError("ACCESS_DENIED", 403, { reason:  "Referer check failed" })
     if (!referer.pathname.startsWith(state.pathPrefix + "/wiki/"))
       return; // keep going
     // we now get the recipe name from the referer
     const recipe_name = referer.pathname.substring(state.pathPrefix.length + "/wiki/".length);
     const referer_slug = decodeURIComponent(recipe_name) as PrismaField<"Recipe", "id">;
     if (referer_slug !== recipe_slug)
-      throw new SendError("CROSS_WIKI_ACCESS_DENIED", 403, null);
+      throw new SendError("ACCESS_DENIED", 403, { reason:  "Referer check failed" })
   }
 
   assertAdminReferer() {
@@ -111,9 +104,9 @@ export class StateObject<
     const referer = new URL(state.headers.referer);
     // deny referers from outside our pathprefix
     if (!referer.pathname.startsWith(state.pathPrefix))
-      throw new SendError("ADMIN_ACCESS_DENIED", 403, null);
+      throw new SendError("ACCESS_DENIED", 403, { reason:  "Referer check failed" })
     if (referer.pathname.startsWith(state.pathPrefix + "/wiki/"))
-      throw new SendError("ADMIN_ACCESS_DENIED", 403, null);
+      throw new SendError("ACCESS_DENIED", 403, { reason:  "Referer check failed" })
   }
 
 

packages/mws/src/SendError.ts

@@ -75,10 +75,8 @@ declare module "@tiddlywiki/server" {
     "OPERATION_NOT_PERMITTED":
     SendErrorItem<403, { reason: string }>
 
-    "CROSS_WIKI_ACCESS_DENIED":
-    SendErrorItem<403, null>
-    "ADMIN_ACCESS_DENIED":
-    SendErrorItem<403, null>
+    "ACCESS_DENIED":
+    SendErrorItem<403, { reason: string }>
   }
 }
 SendError.oninstance.push(e => {

packages/mws/src/new-managers/RecipeResolver.ts

@@ -165,6 +165,8 @@ export class RecipeResolver {
 
     if (!isAdmin && needsWrite) {
 
+      state.okUser();
+
       const hasWriteAccess = recipe.recipe_bags
         .filter(recipeBag => recipeBag.is_writable)
         .some(recipeBag =>

packages/mws/src/new-managers/TabDataAdapter.ts

@@ -533,7 +533,7 @@ export const AdminSave = zodRoute({
   zodRequestBody: z => z.any(),
   inner: async (state) => {
     state.assertAdminReferer();
-    state.asserted = state.user.isAdmin;
+    state.asserted = state.user.isLoggedIn;
     state.data = JSON.parse(JSON.stringify(state.data), (key: any, val: any) => {
       if (typeof val === "string" && val.startsWith(IdString.prefix))
         return new IdString(val.slice(IdString.prefix.length));
@@ -584,7 +584,6 @@ export const AdminLoad = zodRoute({
   securityChecks: { requestedWithHeader: true },
   zodPathParams: z => ({}),
   inner: async (state) => {
-    // access is checked in each list
     state.assertAdminReferer();
     state.asserted = state.user.isLoggedIn;
     const res = await state.$transaction(async prisma => {

packages/mws/src/new-managers/TabUpserts.ts

@@ -88,14 +88,14 @@ export abstract class PerClassImportWriter<Modal extends PrismaModalKeys> {
 
   async checkExisting(id: IdString, name: string, user: ServerRequest["user"]) {
     if (user.isAdmin) { this.asserted = true; }
-    if(this.initStore && typeof user.isLoggedIn === "boolean")
+    if (this.initStore && typeof user.isLoggedIn === "boolean")
       throw new Error("This shouldn't happen.");
+
     if (!user.isAdmin && this.adminLevel) {
-      if (!id.toString()) {
-        throw new SendError("OPERATION_NOT_PERMITTED", 403, {
-          reason: "You don't have permission to create " + this.tabid + "."
-        });
-      }
+
+      if (!id.toString())
+        throw new SendError("ACCESS_DENIED", 403, { reason: "You don't have permission to create " + this.tabid + "." });
+
       const hasPermission: number = await (this.tx[this.modal] as any).count({
         where: {
           id: id.toString(),
@@ -106,26 +106,21 @@ export abstract class PerClassImportWriter<Modal extends PrismaModalKeys> {
             }
           }
         }
-      })
-      if (!hasPermission) {
-        throw new SendError("OPERATION_NOT_PERMITTED", 403, {
-          reason: "You don't have permission to modify " + this.tabid + "."
-        });
-      }
-      this.asserted = true;
+      });
+
+      if (!hasPermission)
+        throw new SendError("ACCESS_DENIED", 403, { reason: "You don't have permission to modify " + this.tabid + "." });
+      else
+        this.asserted = true;
     }
     if (!user.isAdmin && this.tabid === "users") {
       if (user.user_id !== id.toString())
-        throw new SendError("OPERATION_NOT_PERMITTED", 403, {
-          reason: "You must be an admin to edit other users"
-        });
-      this.asserted = true;
+        throw new SendError("ACCESS_DENIED", 403, { reason: "You must be an admin to edit other users" });
+      else
+        this.asserted = true;
     }
     if (!user.isAdmin && this.tabid === "roles") {
-      throw new SendError("OPERATION_NOT_PERMITTED", 403, {
-        reason: "You must be an admin to edit other users"
-      });
-      // this.asserted = true;
+      throw new SendError("ACCESS_DENIED", 403, { reason: "You must be an admin to edit roles" });
     }
     if (id.toString()) {
       const existing = await (this.tx[this.modal] as any).findUnique({