From 9434cd8929516b5bf71415331f31447c7bdca787 Mon Sep 17 00:00:00 2001 From: nikhil2004 Date: Tue, 22 Sep 2026 21:57:54 +0530 Subject: [PATCH] fix: allow owners to view incidents on unpublished status pages --- server/src/api/controllers/statusPageController.ts | 2 +- server/src/domain/status-pages/status-page.service.ts | 10 ++++++---- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/server/src/api/controllers/statusPageController.ts b/server/src/api/controllers/statusPageController.ts index 60f31617d..1c18f00b3 100644 --- a/server/src/api/controllers/statusPageController.ts +++ b/server/src/api/controllers/statusPageController.ts @@ -92,7 +92,7 @@ class StatusPageController implements IStatusPageController { const { url, monitorId } = getPublicMonitorIncidentsParamValidation.parse(req.params); const { date } = getPublicMonitorIncidentsQueryValidation.parse(req.query); - const incidents = await this.statusPageService.getPublicMonitorIncidents(url, monitorId, date); + const incidents = await this.statusPageService.getPublicMonitorIncidents(url, monitorId, date, req.user?.teamId); return res.status(200).json({ success: true, diff --git a/server/src/domain/status-pages/status-page.service.ts b/server/src/domain/status-pages/status-page.service.ts index fe696fde6..5e16c8534 100644 --- a/server/src/domain/status-pages/status-page.service.ts +++ b/server/src/domain/status-pages/status-page.service.ts @@ -29,7 +29,7 @@ export interface IStatusPageService { getStatusPageByCustomDomain(customDomain: string): Promise; getStatusPagesByTeamId(teamId: string): Promise; getPublicStatusPagePayload(statusPage: StatusPage, requesterTeamId: string | undefined, range: StatusPageRange): Promise; - getPublicMonitorIncidents(url: string, monitorId: string, date: string): Promise; + getPublicMonitorIncidents(url: string, monitorId: string, date: string, requesterTeamId?: string): Promise; updateStatusPage(id: string, teamId: string, image: Express.Multer.File | undefined, data: Partial): Promise; deleteStatusPage(statusPageId: string, teamId: string): Promise; @@ -189,12 +189,14 @@ export class StatusPageService implements IStatusPageService { }; }; - getPublicMonitorIncidents = async (url: string, monitorId: string, date: string): Promise => { + getPublicMonitorIncidents = async (url: string, monitorId: string, date: string, requesterTeamId?: string): Promise => { const statusPage = await this.getStatusPageByUrl(url); - // Ensure the status page is public + // Ensure the status page is public or the requester is the owner if (!statusPage.isPublished) { - throw new AppError({ message: "Forbidden", status: 403 }); + if (!requesterTeamId || statusPage.teamId !== requesterTeamId) { + throw new AppError({ message: "Forbidden", status: 403 }); + } } // Ensure the requested monitor actually belongs to this status page