Restrict report interactions

services/ReportService.cc

@@ -103,6 +103,20 @@ bool canModifyReport(const auth::UserContext &user, long long reportId)
         user.id);
     return !result.empty();
 }
+
+bool ownsReport(const auth::UserContext &user, long long reportId)
+{
+    const auto result = drogon::app().getDbClient()->execSqlSync(
+        "SELECT id FROM reports WHERE id = ? AND user_id = ?",
+        reportId,
+        user.id);
+    return !result.empty();
+}
+
+bool canInteractWithReport(const auth::UserContext &user, long long reportId)
+{
+    return ownsReport(user, reportId) || canModifyReport(user, reportId);
+}
 }  // namespace
 
 Json::Value ReportService::createReport(const auth::UserContext &user,
@@ -358,7 +372,8 @@ Json::Value ReportService::addMessage(const auth::UserContext &user,
                                       long long reportId,
                                       const Json::Value &body)
 {
-    if (!canAccessReport(user, reportId) || !validation::hasString(body, "body"))
+    if (!canInteractWithReport(user, reportId) ||
+        !validation::hasString(body, "body"))
     {
         return failure("invalid_message");
     }
@@ -374,7 +389,7 @@ Json::Value ReportService::addMessage(const auth::UserContext &user,
 Json::Value ReportService::listMessages(const auth::UserContext &user,
                                         long long reportId)
 {
-    if (!canAccessReport(user, reportId))
+    if (!canInteractWithReport(user, reportId))
     {
         return failure("forbidden");
     }