diff --git a/server/src/api/controllers/statusPageController.ts b/server/src/api/controllers/statusPageController.ts index 60f31617d..1c18f00b3 100644 --- a/server/src/api/controllers/statusPageController.ts +++ b/server/src/api/controllers/statusPageController.ts @@ -92,7 +92,7 @@ class StatusPageController implements IStatusPageController { const { url, monitorId } = getPublicMonitorIncidentsParamValidation.parse(req.params); const { date } = getPublicMonitorIncidentsQueryValidation.parse(req.query); - const incidents = await this.statusPageService.getPublicMonitorIncidents(url, monitorId, date); + const incidents = await this.statusPageService.getPublicMonitorIncidents(url, monitorId, date, req.user?.teamId); return res.status(200).json({ success: true, diff --git a/server/src/domain/status-pages/status-page.service.ts b/server/src/domain/status-pages/status-page.service.ts index fe696fde6..5e16c8534 100644 --- a/server/src/domain/status-pages/status-page.service.ts +++ b/server/src/domain/status-pages/status-page.service.ts @@ -29,7 +29,7 @@ export interface IStatusPageService { getStatusPageByCustomDomain(customDomain: string): Promise; getStatusPagesByTeamId(teamId: string): Promise; getPublicStatusPagePayload(statusPage: StatusPage, requesterTeamId: string | undefined, range: StatusPageRange): Promise; - getPublicMonitorIncidents(url: string, monitorId: string, date: string): Promise; + getPublicMonitorIncidents(url: string, monitorId: string, date: string, requesterTeamId?: string): Promise; updateStatusPage(id: string, teamId: string, image: Express.Multer.File | undefined, data: Partial): Promise; deleteStatusPage(statusPageId: string, teamId: string): Promise; @@ -189,12 +189,14 @@ export class StatusPageService implements IStatusPageService { }; }; - getPublicMonitorIncidents = async (url: string, monitorId: string, date: string): Promise => { + getPublicMonitorIncidents = async (url: string, monitorId: string, date: string, requesterTeamId?: string): Promise => { const statusPage = await this.getStatusPageByUrl(url); - // Ensure the status page is public + // Ensure the status page is public or the requester is the owner if (!statusPage.isPublished) { - throw new AppError({ message: "Forbidden", status: 403 }); + if (!requesterTeamId || statusPage.teamId !== requesterTeamId) { + throw new AppError({ message: "Forbidden", status: 403 }); + } } // Ensure the requested monitor actually belongs to this status page