Add missing VisibilityRequired annotations (#1434)

HangarMC · Jan 10, 2025 · f6d7795 · f6d7795
1 parent 18a0e40
commit f6d7795
Show file tree

Hide file tree

Showing 5 changed files with 10 additions and 8 deletions.
diff --git a/backend/src/main/java/io/papermc/hangar/controller/api/v1/VersionsController.java b/backend/src/main/java/io/papermc/hangar/controller/api/v1/VersionsController.java
@@ -64,7 +64,7 @@ public UploadedVersion uploadVersion(final ProjectTable project, final List<Mult
     }
 
     @Override
-    @VisibilityRequired(type = VisibilityRequired.Type.PROJECT, args = "{#project}")
+    @VisibilityRequired(type = VisibilityRequired.Type.VERSION, args = "{#version}")
     public Version getVersion(final ProjectTable project, final ProjectVersionTable version) {
         return this.versionsApiService.getVersion(project, version);
     }
@@ -97,18 +97,20 @@ public String getLatestVersion(final ProjectTable project, final @NotNull String
     }
 
     @Override
+    @VisibilityRequired(type = VisibilityRequired.Type.VERSION, args = "{#version}")
     public Map<String, VersionStats> getVersionStats(final ProjectTable project, final ProjectVersionTable version, final @NotNull OffsetDateTime fromDate, final @NotNull OffsetDateTime toDate) {
         return this.versionsApiService.getVersionStats(version, fromDate, toDate);
     }
 
     @Override
+    @VisibilityRequired(type = VisibilityRequired.Type.VERSION, args = "{#version}")
     public Map<String, VersionStats> getVersionStatsById(final ProjectVersionTable version, final @NotNull OffsetDateTime fromDate, final @NotNull OffsetDateTime toDate) {
         return this.versionsApiService.getVersionStats(version, fromDate, toDate);
     }
 
     @Override
     @RateLimit(overdraft = 10, refillTokens = 2)
-    @VisibilityRequired(type = VisibilityRequired.Type.VERSION, args = "{#project, #version, #platform}")
+    @VisibilityRequired(type = VisibilityRequired.Type.VERSION, args = "{#project, #version}")
     public ResponseEntity<?> downloadVersion(final ProjectTable project, final ProjectVersionTable version, final Platform platform, final HttpServletResponse response) {
         return this.downloadService.downloadVersion(project, version, platform);
     }

diff --git a/backend/src/main/java/io/papermc/hangar/controller/internal/VersionController.java b/backend/src/main/java/io/papermc/hangar/controller/internal/VersionController.java
@@ -185,8 +185,7 @@ public void restoreVersion(@PathVariable final long projectId, @PathVariable("ve
 
     @ErrorRedirect
     @RateLimit(overdraft = 5, refillTokens = 1, refillSeconds = 20)
-    @VisibilityRequired(type = VisibilityRequired.Type.VERSION, args = "{#project, #version, #platform}")
-    // TODO is platform needed in the visibility check? it's not used in the VisibilityRequiredVoter
+    @VisibilityRequired(type = VisibilityRequired.Type.VERSION, args = "{#project, #version}")
     @GetMapping(path = "/version/{project}/versions/{version}/{platform}/download", produces = MediaType.APPLICATION_OCTET_STREAM_VALUE)
     public ResponseEntity<?> download(@PathVariable final ProjectTable project, @PathVariable final ProjectVersionTable version, @PathVariable final Platform platform) {
         return this.downloadService.downloadVersion(project, version, platform);

diff --git a/...d/src/main/java/io/papermc/hangar/controller/internal/projects/ProjectPageController.java b/...d/src/main/java/io/papermc/hangar/controller/internal/projects/ProjectPageController.java
@@ -75,6 +75,7 @@ public ResponseEntity<ExtendedProjectPage> getProjectPage(@PathVariable final Pr
 
     @Unlocked
     @RateLimit(overdraft = 5, refillTokens = 1, refillSeconds = 20)
+    @VisibilityRequired(type = VisibilityRequired.Type.PROJECT, args = "{#project}")
     @GetMapping("/list/{projectId}")
     @ResponseStatus(HttpStatus.OK)
     public ResponseEntity<Collection<HangarProjectPage>> listProjectPages(@PathVariable final long projectId) {

diff --git a/...d/src/main/java/io/papermc/hangar/security/annotations/visibility/VisibilityRequired.java b/...d/src/main/java/io/papermc/hangar/security/annotations/visibility/VisibilityRequired.java
@@ -32,7 +32,7 @@
 
     enum Type {
         PROJECT(1),
-        VERSION(1, 3);
+        VERSION(1, 2);
 
         private final Set<Integer> argCount;
 

diff --git a/.../main/java/io/papermc/hangar/security/annotations/visibility/VisibilityRequiredVoter.java b/.../main/java/io/papermc/hangar/security/annotations/visibility/VisibilityRequiredVoter.java
@@ -58,15 +58,15 @@ else if (arguments[0] instanceof String slug) {
                 return ACCESS_DENIED;
             case VERSION:
                 if (arguments.length == 1) {
-                    if (arguments[0] instanceof ProjectVersionTable projectVersionTable) {
+                    if (arguments[0] instanceof final ProjectVersionTable projectVersionTable) {
                         if (this.projectVersionVisibilityService.checkVisibility(projectVersionTable) != null) {
                             return ACCESS_GRANTED;
                         }
                     } else if (this.versionService.getProjectVersionTable((long) arguments[0]) != null) {
                         return ACCESS_GRANTED;
                     }
-                } else if (arguments.length == 3) {
-                    if (arguments[1] instanceof ProjectVersionTable projectVersionTable) {
+                } else if (arguments.length == 2) {
+                    if (arguments[1] instanceof final ProjectVersionTable projectVersionTable) {
                         if (this.projectVersionVisibilityService.checkVisibility(projectVersionTable) != null) {
                             return ACCESS_GRANTED;
                         }