[AvatarController] Restrict UploadAvatar to current user #3839
Conversation
imnasnainaec
added
backend
test
maintenance
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #3839 +/- ##
==========================================
+ Coverage 73.02% 73.19% +0.16%
==========================================
Files 286 286
Lines 10758 10758
Branches 1340 1340
==========================================
+ Hits 7856 7874 +18
+ Misses 2502 2487 -15
+ Partials 400 397 -3
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
| { | ||
| if (!_permissionService.IsUserIdAuthorized(HttpContext, userId)) | ||
| if (!_permissionService.IsCurrentUserAuthorized(HttpContext)) |
There was a problem hiding this comment.
It's intriguing to me that this isn't already handled via the [Authorize] attribute on the controller.
But that's outside the scope of this PR.
There was a problem hiding this comment.
It may be superfluous. I'll look into that, thank you.
| [HttpGet("download", Name = "DownloadAvatar")] | ||
| [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(FileContentResult))] | ||
| [ProducesResponseType(StatusCodes.Status404NotFound)] | ||
| public async Task<IActionResult> DownloadAvatar(string userId) | ||
| { | ||
| // SECURITY: Omitting authentication so the frontend can use the API endpoint directly as a URL. |
There was a problem hiding this comment.
This comment feels somewhat superfluous with the method now explicitly being marked with [AllowAnonymous]
| public void TestUploadAudioFileEmptyFile() | ||
| { | ||
| using var stream = File.OpenRead(_filePath); | ||
| // Use 0 for the third argument |
|
|
Also expand controller testing.
This change is