Bug member security

Author: Bence KOLONICS

.gitlab-ci.yml

@@ -175,7 +175,7 @@ build:frontend:
     - generation:frontend_assets
   script:
     - export NODE_OPTIONS=--openssl-legacy-provider
-    - yarn build --configuration production
+    - yarn build
   artifacts:
     paths:
     - frontend_angular/dist/

api_server/adh6/member/subscription_manager.py

@@ -227,7 +227,7 @@ def validate(self, member_id: int, free: bool) -> None:
         self.membership_repository.validate(subscription.uuid)
         self.add_payment_record(subscription, free)
         self.member_repository.add_duration(subscription.member, subscription.duration)
-        self.notification_manager.send(template_title="Nouvelle cotisation / New subscription", member_email=member.email, subscription_duration=subscription.duration.value, subscription_end=member.departure_date)
+        #self.notification_manager.send(template_title="Nouvelle cotisation / New subscription", member_email=member.email, subscription_duration=subscription.duration.value, subscription_end=member.departure_date)
 
     @log_call
     def add_payment_record(self, membership: Membership, free: bool) -> None:

api_server/openapi/swagger.yaml

@@ -588,8 +588,6 @@ paths:
           $ref: '#/components/responses/Unexpected'
       summary: Retrieve a member
       security: 
-        - OAuth2:
-          - user
         - OAuth2:
           - admin:read
         - ApiKeyAdminAuth: []

api_server/test/integration/test_member.py

@@ -244,6 +244,12 @@ def test_member_get_unauthorized(client):
     )
     assert r.status_code == 403
 
+def test_member_get_another_user(client, sample_member):
+    r = client.get(
+        f'{base_url}{sample_member.id}',
+        headers=TEST_HEADERS_SAMPLE,
+    )
+    assert r.status_code == 403
 
 def test_member_delete_existant(client, sample_member):
     r = client.delete(

frontend_angular/angular.json

@@ -122,7 +122,7 @@
               "aot": true,
               "extractLicenses": true,
               "vendorChunk": false,
-              "buildOptimizer": true,
+              "buildOptimizer": true
             }
           },
           "defaultConfiguration": "production"

frontend_angular/package.json

@@ -8,7 +8,7 @@
     "start:en": "ng serve --configuration=development",
     "build:stats": "ng build --stats-json",
     "analyze": "webpack-bundle-analyzer dist/adh6/fr/stats.json",
-    "build": "ng build --prod",
+    "build": "ng build --configuration production",
     "build:fr": "ng build --configuration=fr",
     "build:en": "ng build --configuration=en",
     "test": "ng test",

openapi/spec.yaml

@@ -588,8 +588,6 @@ paths:
           $ref: '#/components/responses/Unexpected'
       summary: Retrieve a member
       security: 
-        - OAuth2:
-          - user
         - OAuth2:
           - admin:read
         - ApiKeyAdminAuth: []