vynte-infra/plunk
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: Enhance job status retrieval with project authorization

Browse Source
This commit is contained in:
Dries Augustyns
2026-02-19 19:51:22 +01:00
parent eec37ecb31
commit 573e2e8449
2 changed files with 22 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/controllers/Contacts.ts
+4 -2
View File
@@ -315,6 +315,7 @@ export class Contacts {
@Middleware([requireAuth, requireEmailVerified])
@CatchAsync
public async getImportStatus(req: Request, res: Response, _next: NextFunction) {
const auth = res.locals.auth;
const jobId = req.params.jobId;
if (!jobId) {
@@ -322,7 +323,7 @@ export class Contacts {
}
try {
const status = await QueueService.getImportJobStatus(jobId);
const status = await QueueService.getImportJobStatus(jobId, auth.projectId!);
if (!status) {
return res.status(404).json({error: 'Import job not found'});
@@ -502,6 +503,7 @@ export class Contacts {
@Middleware([requireAuth, requireEmailVerified])
@CatchAsync
public async getBulkActionStatus(req: Request, res: Response, _next: NextFunction) {
const auth = res.locals.auth;
const jobId = req.params.jobId;
if (!jobId) {
@@ -509,7 +511,7 @@ export class Contacts {
}
try {
const status = await QueueService.getBulkActionJobStatus(jobId);
const status = await QueueService.getBulkActionJobStatus(jobId, auth.projectId!);
if (!status) {
return res.status(404).json({error: 'Bulk action job not found'});