fix(security): refuse an unresolvable session in requirePreviewAccess — Closes #205

[SakethSumanBathini]

Closes #205

The guard

backend/src/routes/preview.routes.ts read the owner through an optional chain and guarded on truthiness:

const owner = buildExecutor.getSession(sessionId)?.creatorLogin;

if (owner && owner !== login) {
  return res.status(403).send('Access denied');
}

return next();

A falsy owner never reached the comparison, so execution fell through to next(). That covered the case where the session was not in memory at all — which is not exotic, since buildExecutor holds sessions in a plain Map behind a TTL timer with no persistence. Every restart and every expiry empties it, after which no session ID resolves.

It leaked rather than merely failing open because the handler below does not need the in-memory session to serve files; it falls back to reading from disk. The documents were still there, and this check was the only thing between them and any other authenticated user.

After

owner            login   result
"alice"          alice   ALLOWED
"alice"          bob     403 Access denied
null             bob     ALLOWED
session missing  bob     404 Session not found     <- was ALLOWED
""               bob     ALLOWED

The session is resolved once and refused when absent, rather than being reached through an optional chain that erases the difference between "no session" and "no owner".

404 rather than 403 for the missing case, matching checkWorkspaceOwner: it does not reveal whether the ID ever existed, and 404 is already what these handlers return for a missing session.

What this deliberately does not change

creatorLogin: null still passes for any authenticated user. That is the narrower hole flagged at the end of the issue, and it is a product question — sessions created outside an authenticated flow may be intended to be readable.

checkWorkspaceOwner in middleware/auth.ts retains the same creatorLogin && .... Changing it here alone would make the two middlewares disagree about who may read what, which is worse than either behaviour consistently applied. If that case should also be refused, both need the same follow-up in a single change.

The comment

The fix carries its reasoning inline, matching the one already on checkWorkspaceOwner. The mechanism — in-memory Map, TTL expiry, disk fallback — is not visible from the three lines it explains, and this is the second time this exact guard has been written incorrectly in this codebase. The first fix did not stop the second occurrence; a comment at the site might.

Verified

• the truth table above, against the extracted guard
• npx tsc --noEmit clean
• path traversal within the preview root is untouched — the path.sep boundary check further down still runs, and was never the defect
• backend/dev.db untouched

Security fix. Worth merging ahead of #203 and #204, both of which are hardening rather than a live leak.

[coderabbitai]

Warning

Review limit reached

@SakethSumanBathini, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 55 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b7a6952d-d99e-4c55-8c27-813a0e55b10f

📥 Commits

Reviewing files that changed from the base of the PR and between d934ce8 and 9a064da.

📒 Files selected for processing (1)

• backend/src/routes/preview.routes.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}