Restrict report interactions

services/ReportService.cc

@@ -103,6 +103,20 @@ bool canModifyReport(const auth::UserContext &user, long long reportId)
         user.id);
     return !result.empty();
 }
+
+bool ownsReport(const auth::UserContext &user, long long reportId)
+{
+    const auto result = drogon::app().getDbClient()->execSqlSync(
+        "SELECT id FROM reports WHERE id = ? AND user_id = ?",
+        reportId,
+        user.id);
+    return !result.empty();
+}
+
+bool canInteractWithReport(const auth::UserContext &user, long long reportId)
+{
+    return ownsReport(user, reportId) || canModifyReport(user, reportId);
+}
 }  // namespace
 
 Json::Value ReportService::createReport(const auth::UserContext &user,
@@ -358,7 +372,8 @@ Json::Value ReportService::addMessage(const auth::UserContext &user,
                                       long long reportId,
                                       const Json::Value &body)
 {
-    if (!canAccessReport(user, reportId) || !validation::hasString(body, "body"))
+    if (!canInteractWithReport(user, reportId) ||
+        !validation::hasString(body, "body"))
     {
         return failure("invalid_message");
     }
@@ -374,7 +389,7 @@ Json::Value ReportService::addMessage(const auth::UserContext &user,
 Json::Value ReportService::listMessages(const auth::UserContext &user,
                                         long long reportId)
 {
-    if (!canAccessReport(user, reportId))
+    if (!canInteractWithReport(user, reportId))
     {
         return failure("forbidden");
     }

test/test_main.cc

@@ -4,6 +4,7 @@
 #include <drogon/drogon_test.h>
 
 #include "common/GeoJson.h"
+#include "common/Crypto.h"
 #include "common/Validation.h"
 
 #include <future>
@@ -85,6 +86,18 @@ DROGON_TEST(GeoJsonMatchesPointInsidePolygon)
     CHECK(!visione::geojson::pointInPolygon(43.0, 12.5, polygon));
 }
 
+DROGON_TEST(PasswordHashSupportsPbkdf2AndLegacy)
+{
+    const auto hash = visione::crypto::hashPassword("CorrectHorse123!");
+    CHECK(hash.rfind("pbkdf2_sha256$", 0) == 0);
+    CHECK(visione::crypto::verifyPassword("CorrectHorse123!", hash));
+    CHECK(!visione::crypto::verifyPassword("wrong", hash));
+
+    const std::string legacy =
+        "sha256$local-dev-salt$CD4FF6AC8C9685D08E55AF693970F15F9BFCD4C0DC9F4D3001D202C9DB00291F";
+    CHECK(visione::crypto::verifyPassword("ChangeMe123!", legacy));
+}
+
 int main(int argc, char **argv)
 {
     std::promise<void> startedPromise;