(discovery) : Restrict Endorsement Requests Visibility to User's Own Requests

[tejaskh3]

Description

We have discovered an issue on the https://skills.realdevsquad.com/requests page where we are able to see all the endorsements for a user, even if we have not endorsed them. Instead, we should only be able to view the endorsement requests where we have provided an endorsement to the respective user.

Expected Behaviour

• We should only be able to view the endorsement requests that we have created.

Current Behaviour

• Currently, we are able to see all endorsement requests, even those that we have neither started nor participated in.

Steps to Reproduce

1. Go to the https://skills.realdevsquad.com/requests .
2. Click on the Create Endorsement button and raise a request for a user where there is already a pending, accepted, or rejected request.
3. After raising the request, go back to the URL from Step 1, and you will be able to see all the requests (including those you have not started or participated in).

Screenshots

[mbramani]

This is discussed in the hangout call and given to me by @ankushdharkar

[mbramani]

Hey @ankushdharkar @tejaskh3

There's an issue with how the endorsement requests are being filtered for regular users. In the SkillServiceImplementation#getAllRequests() method, for non–superusers the code calls:

skillRequests = userSkillRepository.findUserSkillsByEndorserId(userId);

Issue Breakdown:

1. The repository method findUserSkillsByEndorserId is defined as:
   @Query("SELECT us FROM UserSkills us JOIN Endorsement e ON us.userId = e.endorseId WHERE e.endorserId = :endorserId")
   This query returns all UserSkills entries that have at least one associated Endorsement for which the given user is the endorser. In other words, it lists requests where someone was endorsed by the current user.

2. However, the expected behavior is that a user should see only the endorsement requests they have created (i.e. where they are the requester) rather than requests they might have endorsed. Using findUserSkillsByEndorserId ends up showing endorsements regardless of whether the current user created the request or not.

3. This is why after raising a request even if we haven’t endorsed that specific person we end up seeing all requests because the method isn’t filtering for “requests created by the user.”

How to Fix It

We need to update the filtering logic for non–superusers so that it only returns endorsement requests initiated by the current user. This might mean introducing a new repository method to filter on the creator of the request rather than on the endorser.

[Shyam-Vishwakarma]

PR #196 closes this.