From 1cfbf1db491a2683631939de05effa1e753279cf Mon Sep 17 00:00:00 2001 From: nlevesque Date: Tue, 28 Jul 2026 23:55:31 +0200 Subject: [PATCH] Scope /mycards and dashboard to own cards only The Directus read permission intentionally allows friends' collections (used by /friends/[username]); the own-collection pages need an explicit user = current-user filter on top of it. --- src/pages/index.astro | 8 ++++++-- src/pages/mycards.astro | 9 +++++++-- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/src/pages/index.astro b/src/pages/index.astro index 56eaaba..2bdc80c 100644 --- a/src/pages/index.astro +++ b/src/pages/index.astro @@ -14,9 +14,13 @@ if (!isLoggedIn(Astro.locals)) { return Astro.redirect("/login"); } -// Owner-scoping is enforced by the Directus permissions +// Own cards only (the read permission also allows friends' collections, +// which is what /friends/[username] uses — here we want just ours) const myCards = (await directus!.request( - readItems("mycards", { limit: -1 }), + readItems("mycards", { + filter: { user: { _eq: Astro.locals.user!.id } }, + limit: -1, + }), )) as MyCardRecord[]; // Fetch prices through the 24h-cached card endpoint diff --git a/src/pages/mycards.astro b/src/pages/mycards.astro index 56c7a6d..a0ea1fb 100644 --- a/src/pages/mycards.astro +++ b/src/pages/mycards.astro @@ -13,9 +13,14 @@ if (!isLoggedIn(Astro.locals)) { return Astro.redirect("/login"); } -// Fetch all user's cards (owner-scoping enforced by Directus permissions) +// Own cards only (the read permission also allows friends' collections, +// which is what /friends/[username] uses — here we want just ours) const myCards = (await directus!.request( - readItems("mycards", { sort: ["-date_created"], limit: -1 }), + readItems("mycards", { + filter: { user: { _eq: Astro.locals.user!.id } }, + sort: ["-date_created"], + limit: -1, + }), )) as MyCardRecord[]; const cardsWithPrice = await priceCollectionCards(myCards);