Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[PAY-3240] Prevent wrong users from seeing /edit pages #9298

Merged
merged 2 commits into from
Jul 30, 2024
Merged

[PAY-3240] Prevent wrong users from seeing /edit pages #9298

merged 2 commits into from
Jul 30, 2024

Conversation

raymondjacobson
Copy link
Member

@raymondjacobson raymondjacobson commented Jul 30, 2024 •
edited
Loading

Description

Prevent users from seeing /edit pages when they should not

  • /edit requires an account
  • /edit requires you to manage the account you are modifying
  • a few misc console cleanups

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Provide repro instructions & any configuration.

  • owner can edit tracks/ collections
  • managed user cannot edit owners tracks / collections
  • manager can manage a managed users tracks / collections

@changeset-bot changeset-bot
Copy link

changeset-bot bot commented Jul 30, 2024 •
edited
Loading

⚠️ No Changeset found

Latest commit: 1550daa

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

amendelsohn
amendelsohn approved these changes Jul 30, 2024
View reviewed changes
packages/web/src/hooks/useManagedAccountNotAllowedRedirect.ts
*/
export const useManagedAccountForHandleNotAllowedRedirect = (
handle: string,
route: string = FEED_PAGE
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we just route them back by default so people don't lose their work? or does that risk too many infinite loops and confusing scenarios? feed definitely safer

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah it's a good callout. I'm worried that most users would just end up here by accidentally copying and pasting a link and sending it to someone else, and it will redirect them before they're unable to type anything. I think ok for now, but def down to revisit!

packages/web/src/pages/edit-collection-page/desktop/EditCollectionPage.tsx Outdated
Comment on lines 47 to 48
useRequiresAccount()
useManagedAccountForHandleNotAllowedRedirect(handle)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is neat

@audius-infra
Copy link
Collaborator

Preview this change https://demo.audius.co/rj-pay-3240-2

@raymondjacobson raymondjacobson merged commit d87357e into main Jul 30, 2024
19 of 21 checks passed
@raymondjacobson raymondjacobson deleted the rj-pay-3240-2 branch July 30, 2024 07:51
schottra added a commit that referenced this pull request Jul 30, 2024
@schottra
Merge remote-tracking branch 'origin/main' into pay-2917-user-endpoints
619d7b4 
* origin/main: (69 commits)
  Update dn models (#9291)
  [PAY-3260] Use 'Today' for matching release dates (#9292)
  [PAY-3258] BoxedTextField can error before form submission (#9305)
  [PAY-3248][PAY-3256][PAY-3234] Fix misc android issues (#9307)
  Premium extras updates (#9306)
  Silence request logs for python es client (#9301)
  [PAY-3263] add playlists & albums release date if null (#9304)
  Small FilterButton hover style tweak (#9303)
  [QA-1448] Fix user badge spacing (#9302)
  [C-4868] BPM validation (#9295)
  [C-4854] Add Premium Extras label (#9294)
  [PAY-3261] Update remix settings copy (#9299)
  Audius Protocol v0.6.158
  Longer deadline for fixing files (#9297)
  [PAY-3236][PAY-3242][PAY-3259] Fix play button in tracks table (#9288)
  [PAY-3240] Prevent wrong users from seeing /edit pages (#9298)
  PAY-3233 Disable reset on select field for AM/PM (#9296)
  [PAY-3249] Implement pnagD trending strategy (#9273)
  [PAY-3257] Default prices for premium albums/tracks (#9293)
  Pin Rust version to 1.79.0 (#9290)
  ...
audius-infra pushed a commit that referenced this pull request Aug 3, 2024
Audius Client (Web and Mobile) v1.5.93
cea2bea 
[7e9ef50] [C-4681] [C-4680] Add analytics for search v2 (#9363) Sebastian Klingler
[d9b0c78] [PAY-3279] Fix misc web album UI issues (#9362) Raymond Jacobson
[1b494ff] Improve SDK rewards claiming errors with RewardManagerError abstraction (#9214) Marcus Pasell
[05720e3] [C-4891] Add artist pick to mobile (#9359) Dylan Jeffers
[932ddc7] Add cors headers for actions (#9360) Raymond Jacobson
[56409de] [C-4798] Filter all categories by verified (#9353) Sebastian Klingler
[048a4d8] [PAY-3253] Fix confirmation drawer height (#9310) Dylan Jeffers
[245baf4] [C-4915] Fix create collection card height (#9357) Dylan Jeffers
[216a3fb] [C-4895] Fix profile screen verified badge (#9356) Dylan Jeffers
[9500340] [C-4899] Fix isrc and iswc validation (#9352) Dylan Jeffers
[7c780e8] Fix sign in (#9355) Dylan Jeffers
[654e7a1] Add IconTowerBroadcast to harmony (#9354) Andrew Mendelsohn
[a225c68] [PAY-3311] Create one_to_many_dms flag (#9351) Andrew Mendelsohn
[6271d09] [C-4896] [C-4893] [C-4913] BPM precision adjustments (#9349) Sebastian Klingler
[dc2a681] Remove null checks for metadata items in useXMetadata (#9350) Reed
[06cbc13] Hide play counts for all gated content in TracksTable (#9347) Reed
[4de149f] [C-4897] Improve empty edit collection page (#9346) Dylan Jeffers
[67cbdfe] Update dapp-store build artifacts audius-infra
[f1d908b] Fix show premium downloads message (#9344) Saliou Diallo
[34445b8] [C-3907] Add empty state for artist results in sign up flow (#9343) Kyle Shanks
[dc84357] add bpm edit flag col (#9324) Michelle Brier
[b50abba] Add actions.json to cloudflare (#9341) Raymond Jacobson
[8e9f6c3] [PAY-3283] Show high res artwork in edit (#9342) Raymond Jacobson
[e91b12a] [C-4905] Fix app crash when navigating to let them dj when signed out (#9340) Kyle Shanks
[8dbbd21] Add actions.json for solana blink support (#9331) Raymond Jacobson
[3e70a7f] [QA-1374] Fix play/preview logic on track page (#9337) Dylan Jeffers
[1e35fc3] [PAY-3298] Fix track preview generation (#9339) Dylan Jeffers
[6867056] [C-4903] Update icon sizes for collection card actions and notifications (#9338) Kyle Shanks
[6c7a231] [PAY-3271] Prevent navigation prompt from showing on delete (#9336) Andrew Mendelsohn
[e1b8690] PAY-3290 Special Access should disable entirely (#9334) Marcus Pasell
[0a64f84] PAY-3291 Don't show purchase in overflow menu for non-purchase-gated tracks (#9335) Marcus Pasell
[0b2c061] PAY-3287 Validate main form on submitting access gate subform mobile (#9332) Marcus Pasell
[9e81415] PAY-3288 Fix edit collection confirmations on mobile (#9330) Marcus Pasell
[a3bfb57] Fix CollectionCard test (#9329) Sebastian Klingler
[e6374bc] [PAY-3282] Prevent publishing 0 length playlist (#9328) Raymond Jacobson
[b799fcb] typescript impl of R2(crc32) + R2(sha256) ordering. (#8942) Steve Perkins
[eb8724e] PAY-3275 Portal drawers to the correct location (#9325) Marcus Pasell
[f404f01] Remove legacy edit track (#9323) Andrew Mendelsohn
[11f0ed5] [PAY-3274] Show 'releases today' on mobile (#9314) Andrew Mendelsohn
[18f4bea] [PAY-3197] Remove gated-content-upload-prompt drawer (#9318) Reed
[c36b94c] C-4894 Make edit track/edit collection use same buttons (#9321) Marcus Pasell
[1b6a1b7] Migrate sign out confirmation drawer to harmony (#9320) Reed
[7c8a654] [PAY-3254] Fix edit remix (#9322) Dylan Jeffers
[9bd24c8] [C-4885] [C-4888] [C-4889] [C-4882] [C-4883] Advanced search UI fixes pt 3 (#9317) Sebastian Klingler
[619da11] Fix "date required" error when selecting date (#9315) Dylan Jeffers
[c29f8f8] [PAY-3277] Show release date for all public tracks/collections (#9313) Reed
[885479a] Update users endpoints: round 1 (#9166) Randy Schott
[8618e3c] PAY-3280 Fix gated access display (#9311) Marcus Pasell
[69e76c7] [PAY-3276] No scheduled playlists (#9312) Dylan Jeffers
[91197d4] [PAY-3262] Fix edit new playlist (#9309) Dylan Jeffers
[1c61e0b] Update dn models (#9291) Randy Schott
[cf20265] [PAY-3260] Use 'Today' for matching release dates (#9292) Andrew Mendelsohn
[3290d1e] [PAY-3258] BoxedTextField can error before form submission (#9305) Saliou Diallo
[1dd131f] [PAY-3248][PAY-3256][PAY-3234] Fix misc android issues (#9307) Raymond Jacobson
[782e9d9] Premium extras updates (#9306) Dylan Jeffers
[61cc53a] Small FilterButton hover style tweak (#9303) Sebastian Klingler
[f7cf7d1] [QA-1448] Fix user badge spacing (#9302) Kyle Shanks
[5af538a] [C-4868] BPM validation (#9295) Sebastian Klingler
[22ca755] [C-4854] Add Premium Extras label (#9294) Dylan Jeffers
[b66ca17] [PAY-3261] Update remix settings copy (#9299) Raymond Jacobson
[f713455] [PAY-3236][PAY-3242][PAY-3259] Fix play button in tracks table (#9288) Saliou Diallo
[d87357e] [PAY-3240] Prevent wrong users from seeing /edit pages (#9298) Raymond Jacobson
[8b92b23] PAY-3233 Disable reset on select field for AM/PM (#9296) Marcus Pasell
[3a63fbb] [PAY-3257] Default prices for premium albums/tracks (#9293) Andrew Mendelsohn
[7d41d87] [C-4836] Adjust FilterButton active states (#9289) Sebastian Klingler
[f680c81] [QA-1473] Fix duplicate purchase button in TracksTable row (#9284) Sebastian Klingler
[97bf97d] Fix use-revert-on-cancel (#9286) Dylan Jeffers
[2b9b811] Bump mobile to 109 (#9283) Dylan Jeffers
[68ebca7] Update copy for preview length (#9280) Sebastian Klingler
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@amendelsohn amendelsohn amendelsohn approved these changes

@sddioulde sddioulde Awaiting requested review from sddioulde

Assignees
No one assigned
Labels
size/M
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@raymondjacobson @audius-infra @amendelsohn