Repository navigation
GET /documents/risk-assessments returns every user's documents and can be shadowed by GET /documents/:id #1474
Description
listRiskAssessments calls findByRiskFilters, which has no owner filter, so any authenticated user receives other users' document ids, titles, scores and risk flags. The route also lives in a second controller with the same documents prefix as DocumentsController, whose @Get(':id') has no ParseUUIDPipe; depending on module registration order the static path can be matched as id = 'risk-assessments'.
Where
backend/src/risk-assessment/risk-assessment.controller.tsbackend/src/documents/documents.service.ts (findByRiskFilters)backend/src/documents/documents.controller.ts (getDocument)
Suggested fix
Scope the query to the caller (admins may opt in to all), move the route to a non-conflicting path such as /risk-assessments, and add ParseUUIDPipe to :id routes.
Acceptance criteria
- A user only sees their own documents; admin behaviour is explicit
-
GET /documents/risk-assessments(or its new path) never reachesgetDocument - e2e test with two users
Activity
RUKAYAT-CODER commentedon Oct 17, 2026
@RUKAYAT-CODER has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @RUKAYAT-CODER to this issue.
drips-wave commentedon Oct 17, 2026
Congratulations, @RUKAYAT-CODER! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.
🧑💻 @RUKAYAT-CODER: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊
grantfox-oss commentedon Oct 17, 2026
🎉 This issue has been marked as completed on GrantFox!
@RUKAYAT-CODER's PR #1544 was approved and merged by @mftee.
🏆 @RUKAYAT-CODER: You earned 40 FoxPoints for this contribution! Your current tier: Builder (1,828 total points). Track your full progress on GrantFox.
👏 Great work, @RUKAYAT-CODER! Keep contributing to CodeGirlsInc.
drips-wave commentedon Oct 17, 2026
This issue has been completed by @RUKAYAT-CODER as part of the Stellar Wave Program's 10th Wave 🥳
😎 @RUKAYAT-CODER: You earned 200 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.
🧑💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.
fix(backend): scope document access and add admin user + API key endp…