Skip to content

security: restrict consequential mutations to admin and owner #178

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
GoddeyUwamari merged 1 commit into from
Oct 6, 2026
Merged

security: restrict consequential mutations to admin and owner #178

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion backend/src/controllers/__tests__/stripe-checkout-session.security.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ async function insertOrgWithCustomer(): Promise<{ orgId: string; customerId: str

function mockReqRes(body: any, organizationId: string) {
const req = {
user: { organizationId, email: `owner-${uniqueSuffix()}@example.com` },
user: { organizationId, email: `owner-${uniqueSuffix()}@example.com`, role: 'owner' },
body,
} as unknown as Request;

Expand Down
8 changes: 5 additions & 3 deletions backend/src/controllers/stripe.controller.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,9 +52,9 @@ const REFUND_ISSUED_NOT_RECORDED_MESSAGE =

export class StripeController {
/**
* Billing mutations (cancel, resume, change plan, open the Customer
* Portal) are restricted to organization owners/admins -- members and
* viewers can still read billing state (getSubscription/getInvoices)
* Billing mutations (start checkout, cancel, resume, change plan, open
* the Customer Portal) are restricted to organization owners/admins --
* members and viewers can still read billing state (getSubscription/getInvoices)
* but must not be able to mutate the whole organization's subscription.
* Role comes exclusively from req.user.role, set server-side by
* authenticate() from the caller's current organization membership --
Expand Down Expand Up @@ -91,6 +91,8 @@ export class StripeController {
return;
}

if (!this.requireBillingAdmin(req, res)) return;

// The server is authoritative here: only a known tier + billing
// interval are accepted from the client. The Stripe Price ID and the
// success/cancel URLs are resolved/fixed server-side and are never
Expand Down
Loading
Loading