From 77744d9174bd0a5190b83db73e1670e4833e1d99 Mon Sep 17 00:00:00 2001
From: gabdevele <schiraldigabriele@gmail.com>
Date: Tue, 2 Jun 2026 20:05:41 +0200
Subject: [PATCH] Restrict report interactions

---
 services/ReportService.cc | 19 +++++++++++++++++--
 test/test_main.cc         | 13 +++++++++++++
 2 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/services/ReportService.cc b/services/ReportService.cc
index 9becad7..29b3ee7 100644
--- a/services/ReportService.cc
+++ b/services/ReportService.cc
@@ -103,6 +103,20 @@ bool canModifyReport(const auth::UserContext &user, long long reportId)
         user.id);
     return !result.empty();
 }
+
+bool ownsReport(const auth::UserContext &user, long long reportId)
+{
+    const auto result = drogon::app().getDbClient()->execSqlSync(
+        "SELECT id FROM reports WHERE id = ? AND user_id = ?",
+        reportId,
+        user.id);
+    return !result.empty();
+}
+
+bool canInteractWithReport(const auth::UserContext &user, long long reportId)
+{
+    return ownsReport(user, reportId) || canModifyReport(user, reportId);
+}
 }  // namespace
 
 Json::Value ReportService::createReport(const auth::UserContext &user,
@@ -358,7 +372,8 @@ Json::Value ReportService::addMessage(const auth::UserContext &user,
                                       long long reportId,
                                       const Json::Value &body)
 {
-    if (!canAccessReport(user, reportId) || !validation::hasString(body, "body"))
+    if (!canInteractWithReport(user, reportId) ||
+        !validation::hasString(body, "body"))
     {
         return failure("invalid_message");
     }
@@ -374,7 +389,7 @@ Json::Value ReportService::addMessage(const auth::UserContext &user,
 Json::Value ReportService::listMessages(const auth::UserContext &user,
                                         long long reportId)
 {
-    if (!canAccessReport(user, reportId))
+    if (!canInteractWithReport(user, reportId))
     {
         return failure("forbidden");
     }
diff --git a/test/test_main.cc b/test/test_main.cc
index 33aa568..6885426 100644
--- a/test/test_main.cc
+++ b/test/test_main.cc
@@ -4,6 +4,7 @@
 #include <drogon/drogon_test.h>
 
 #include "common/GeoJson.h"
+#include "common/Crypto.h"
 #include "common/Validation.h"
 
 #include <future>
@@ -85,6 +86,18 @@ DROGON_TEST(GeoJsonMatchesPointInsidePolygon)
     CHECK(!visione::geojson::pointInPolygon(43.0, 12.5, polygon));
 }
 
+DROGON_TEST(PasswordHashSupportsPbkdf2AndLegacy)
+{
+    const auto hash = visione::crypto::hashPassword("CorrectHorse123!");
+    CHECK(hash.rfind("pbkdf2_sha256$", 0) == 0);
+    CHECK(visione::crypto::verifyPassword("CorrectHorse123!", hash));
+    CHECK(!visione::crypto::verifyPassword("wrong", hash));
+
+    const std::string legacy =
+        "sha256$local-dev-salt$CD4FF6AC8C9685D08E55AF693970F15F9BFCD4C0DC9F4D3001D202C9DB00291F";
+    CHECK(visione::crypto::verifyPassword("ChangeMe123!", legacy));
+}
+
 int main(int argc, char **argv)
 {
     std::promise<void> startedPromise;