Improve security

src/reader/get.rs

@@ -1,3 +1,4 @@
+use crate::auth::extractor::AuthUser;
 use crate::error::AppError;
 use crate::json_serialization::user::JsonUser;
 use crate::models::feed::rss_feed::Feed;
@@ -10,17 +11,25 @@ use crate::{
     schema::feed::{self, user_id},
     schema::feed_item,
 };
-use actix_web::{web, HttpRequest, Responder};
+use actix_web::{web, HttpRequest, HttpResponse, Responder};
 use chrono::Local;
 use diesel::prelude::*;
 
 use super::structs::article::Article;
 
-pub async fn get(path: web::Path<JsonUser>, req: HttpRequest) -> Result<impl Responder, AppError> {
+pub async fn get(
+    path: web::Path<JsonUser>,
+    req: HttpRequest,
+    auth_user: AuthUser,
+) -> Result<HttpResponse, AppError> {
     let request = req.clone();
     let req_user_id = path.user_id;
     log::info!("Received user_id: {}", req_user_id);
 
+    if auth_user.0 != req_user_id {
+        return Ok(HttpResponse::Forbidden().finish());
+    }
+
     let mut connection: diesel::PgConnection = establish_connection();
     let feeds: Vec<Feed> = feed::table
         .filter(user_id.eq(req_user_id))
@@ -69,15 +78,17 @@ pub async fn get(path: web::Path<JsonUser>, req: HttpRequest) -> Result<impl Res
         feeds: feed_aggregates,
     };
 
-    Ok(articles.respond_to(&request))
+    Ok(articles.respond_to(&request).map_into_boxed_body())
 }
 
 #[cfg(test)]
 mod tests {
+    use actix_service::Service;
     use actix_web::http::StatusCode;
-    use actix_web::{test, web, App};
+    use actix_web::{test, web, App, HttpMessage};
 
     use super::get;
+    use crate::auth::extractor::AuthUser;
     use crate::database::establish_connection;
     use crate::test_helpers::{
         delete_feed, delete_feed_item, delete_user, insert_feed, insert_feed_item, insert_user,
@@ -91,8 +102,16 @@ mod tests {
         let unread = insert_feed_item(&mut connection, feed.id, false);
         let read = insert_feed_item(&mut connection, feed.id, true);
 
-        let app =
-            test::init_service(App::new().route("/get/{user_id}", web::get().to(get))).await;
+        let user_id = user.id;
+        let app = test::init_service(
+            App::new()
+                .wrap_fn(move |req, srv| {
+                    req.extensions_mut().insert(AuthUser(user_id));
+                    srv.call(req)
+                })
+                .route("/get/{user_id}", web::get().to(get)),
+        )
+        .await;
         let req = test::TestRequest::get()
             .uri(&format!("/get/{}", user.id))
             .to_request();
@@ -111,4 +130,30 @@ mod tests {
         delete_feed(&mut connection, feed.id);
         delete_user(&mut connection, user.id);
     }
+
+    #[actix_web::test]
+    async fn get_rejects_requests_for_another_user() {
+        let mut connection = establish_connection();
+        let user_a = insert_user(&mut connection, "secret");
+        let user_b = insert_user(&mut connection, "secret");
+
+        let app = test::init_service(
+            App::new()
+                .wrap_fn(move |req, srv| {
+                    req.extensions_mut().insert(AuthUser(user_a.id));
+                    srv.call(req)
+                })
+                .route("/get/{user_id}", web::get().to(get)),
+        )
+        .await;
+        let req = test::TestRequest::get()
+            .uri(&format!("/get/{}", user_b.id))
+            .to_request();
+        let resp = test::call_service(&app, req).await;
+
+        assert_eq!(StatusCode::FORBIDDEN, resp.status());
+
+        delete_user(&mut connection, user_a.id);
+        delete_user(&mut connection, user_b.id);
+    }
 }