From 4f59afeeb0048a92abafb148ca1db607f64a9671 Mon Sep 17 00:00:00 2001 From: Dotta Date: Wed, 15 Jul 2026 05:06:04 +0000 Subject: [PATCH] fix(server): preserve company-scoped read privacy Co-Authored-By: Paperclip --- server/src/__tests__/issue-attachment-routes.test.ts | 3 ++- server/src/routes/issues.ts | 8 ++------ 2 files changed, 4 insertions(+), 7 deletions(-) diff --git a/server/src/__tests__/issue-attachment-routes.test.ts b/server/src/__tests__/issue-attachment-routes.test.ts index f92ff010a90..c03d1a8bd1f 100644 --- a/server/src/__tests__/issue-attachment-routes.test.ts +++ b/server/src/__tests__/issue-attachment-routes.test.ts @@ -445,7 +445,8 @@ describe("issue attachment routes", () => { const res = await request(app) .get("/api/issues/11111111-1111-4111-8111-111111111111/attachments/archive"); - expect(res.status).toBe(403); + expect(res.status).toBe(404); + expect(res.body).toEqual({ error: "Issue not found" }); expect(mockIssueService.listAttachments).not.toHaveBeenCalled(); expect(storage.getObject).not.toHaveBeenCalled(); }); diff --git a/server/src/routes/issues.ts b/server/src/routes/issues.ts index bf930ccabce..43bcb2f1273 100644 --- a/server/src/routes/issues.ts +++ b/server/src/routes/issues.ts @@ -12629,12 +12629,8 @@ export function issueRoutes( router.get("/issues/:id/attachments/archive", async (req, res, next) => { const issueId = req.params.id as string; - const issue = await svc.getById(issueId); - if (!issue) { - res.status(404).json({ error: "Issue not found" }); - return; - } - assertCompanyAccess(req, issue.companyId); + const issue = await getAccessibleResource(req, res, svc.getById(issueId), "Issue not found"); + if (!issue) return; if (!(await assertIssueReadAllowed(req, res, issue))) return; const [attachments, issueDocuments] = await Promise.all([