mfrachet / progressively Goto Github PK

Some endpoints were only verifying against the project ID passed as argument in order to determine whether the resource is forbidden or not.

Context

For instance, let's say we have a project A with env 1 and 2 and a project B with env 3.

• If a user of the project A tries to get /projects/A/environments/1/flags, they get the flag of the env 1
• If a user of the project A tries to get /projects/B/environments/13flags, they get a 403
• HOWEVER, - If a user of project A tries to get /projects/A/environments/**3**/flags, they get the flags of the env 3 without having access to it.

• Special chars
• Length etc...
• Remove the password generation constraint in project.controller when adding a member (filling an empty password instead of a math.random one)

Make sure to have ping/pong for websockets and eventually to fallback to API interval when the connection can't be established (polling instead of pushing when necessary)

In order to deal with advanced rollout strategies such as "percentage-based", the user id needs to exist in the field passed to the API.

In Progressively, the user ID should be passed in the fields props of the provider like following:

 const ssrProps = await getSSRProps("valid-sdk-key", {
    fields: {
      id: "1",
    },
  });

The problem appears when the user is anonymous: how to use a "consistent-ish" id to display the valid variant to the user on subsequent visits?

When running only client-side only (no SSR)

• Generate the ID with nanoid in Nestjs #69
• Store it in a cookie #69
• Init WebSockets with the value in the cookie #72

When running on the server + client-side (with SSR)

• Generate the user ID in Nestjs with nanoid #69
• Send it back to the SSR client in a cookie #70
• Init WebSockets with the value in the cookie #72

Does not seem necessary but to keep in mind

Not necessary since the API will always request using the field id

• forward the request to the API
• On subsequent requests, the client sends the cookie to the server (make sure to forward it from next to nestjs)