mosaic/stack
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix(api): Add WorkspaceGuard to controllers and fix route ordering #111

Closed
jason.woltje wants to merge 0 commits from fix/controller-guards into develop
pull from: fix/controller-guards
merge into: mosaic:develop
Conversation 0 Commits - Files Changed -
jason.woltje commented 2026-01-30 02:16:10 +00:00
Owner
Copy Link

Summary

Fixes High priority issues from code review.

Controllers Fixed (7)

  • events.controller.ts
  • domains.controller.ts
  • projects.controller.ts
  • ideas.controller.ts
  • layouts.controller.ts
  • tags.controller.ts
  • activity.controller.ts

Changes

  1. Proper guards: @UseGuards(AuthGuard, WorkspaceGuard, PermissionGuard)
  2. Workspace decorator: Replaced manual req.user?.workspaceId with @Workspace()
  3. Permission decorators: Added @RequirePermission() for proper RBAC
  4. CurrentUser decorator: Cleaner user access

Route Ordering Fixes

  • layouts.controller.ts: @Get("default") moved before @Get(":id")
  • auth.controller.ts: @Get("profile") moved before @All("*")

Impact

  • All endpoints now properly validate workspace access
  • Role permissions enforced
  • No more route collisions
## Summary Fixes **High** priority issues from code review. ## Controllers Fixed (7) - events.controller.ts - domains.controller.ts - projects.controller.ts - ideas.controller.ts - layouts.controller.ts - tags.controller.ts - activity.controller.ts ## Changes 1. **Proper guards**: `@UseGuards(AuthGuard, WorkspaceGuard, PermissionGuard)` 2. **Workspace decorator**: Replaced manual `req.user?.workspaceId` with `@Workspace()` 3. **Permission decorators**: Added `@RequirePermission()` for proper RBAC 4. **CurrentUser decorator**: Cleaner user access ## Route Ordering Fixes - `layouts.controller.ts`: `@Get("default")` moved before `@Get(":id")` - `auth.controller.ts`: `@Get("profile")` moved before `@All("*")` ## Impact - All endpoints now properly validate workspace access - Role permissions enforced - No more route collisions
jason.woltje added 1 commit 2026-01-30 02:16:10 +00:00
fix(api): add WorkspaceGuard to controllers and fix route ordering 48abdbba8b
jason.woltje closed this pull request 2026-01-30 03:04:04 +00:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
ai
AI/LLM integration
 api
Backend/API work
 api
auth
Authentication
 database
database
Database/schema work
 devops
Docker/deployment
 docs
Documentation
 frontend
graph
knowledge-module
migration
Data migration
 orchestrator
Orchestrator service (apps/orchestrator/)
 p0
Critical priority
 p1
High priority
 p2
Medium priority
 p3
Low priority
 performance
Performance work
 phase-1
phase-2
phase-3
phase-4
phase-5
plugin
MoltBot plugin work
 search
security
Security-related
 setup
Initial setup
 testing
Testing/QA
 web
Frontend work
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaic/stack#111
Delete Branch "fix/controller-guards"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?