fix(events): enforce role checks for host and moderator in joinEvent by geekyvaishnavi · Pull Request #2657 · RealDevSquad/website-backend

geekyvaishnavi · 2026-10-11T14:52:33Z

Issue Ticket Number

Closes RealDevSquad/website-www#1180

Tech Doc Link

doc

Business Doc Link

N/A

Description

POST /events/join-admin was giving out tokens for roles the user is not allowed to have. A member who is not a super_user could get a host token, and a super_user who is not a member could get a moderator token. The UI blocks both cases, but calling the API directly skipped that check.
When the role checks in the host/moderator block of joinEvent failed, the request fell through to the guest section, which created a token using the role from the request body. This PR returns 403 with no token at the end of that block in controllers/events.js.
Refactored joinEvent: the token is now created in one place instead of four, the host/moderator checks are grouped under one isPrivilegedRole block, and the maven event code check uses .some().
POST /events/join with host/moderator and no login now returns 401 instead of 400, matching the authenticate middleware and res.boom.unauthorized used across the app.

Checklist

Screenshots

Screenshot

Before the fix: the API gives a member a host token.

After the fix: the same request is rejected.

Test Coverage

Test report

Added 6 integration tests in test/integration/events.test.js for the 403 (wrong role), 401 (not logged in) and maven event code cases. All 32 tests in the file pass.

Additional Notes

No UI change is needed, because the UI already enforces these rules in live.js. A super_user who is not a member now gets 403 for the moderator role, which matches the UI. Super users can still join as host.

…ator

…ed role

coderabbitai · 2026-10-11T14:52:49Z

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 597af7c7-bd6b-4add-9d32-d5143b7a85b0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: f0908df1-5530-49a7-96f3-1352430d76a4

📥 Commits

Reviewing files that changed from the base of the PR and between 86915d7 and a12c6f2.

📒 Files selected for processing: 1

controllers/events.js

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Summary by CodeRabbit

Bug Fixes
- Requests to join an event as a host or moderator now receive a permission error when the account lacks the required role, rather than receiving an access token.

Walkthrough

The join endpoint now returns HTTP 403 when a user fails the authorization check for a host or moderator role. Integration tests verify both cases and confirm that the endpoint does not request an auth token.

Changes

Event role authorization

Layer / File(s)	Summary
Reject unauthorized privileged roles `controllers/events.js`, `test/integration/events.test.js`	The controller rejects unauthorized host and moderator requests with HTTP 403. Integration tests check the permission-denied response and confirm that no token is returned or requested.

Priority: ⬆️ High

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix · Severity of issue fixed: High

Merge Risk: ⚪ Minimal · up to a12c6

Unauthorized host and moderator join requests are rejected before a token is issued, and the integration suite covers permitted and denied role combinations. No actionable merge-blocking risk remains from the reviewed change.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Linked Issues check		Issue `#1180` requires API enforcement for host and moderator roles, no token for declined requests, unchanged guest and maven joining, and integration tests for permitted and declined cases. `controlle…
Out of Scope Changes check		The changed files are limited to `controllers/events.js` and `test/integration/events.test.js`. The controller changes enforce issue `#1180` and preserve valid maven token generation through the shared …
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Title check		The title clearly describes the main change: enforcing host and moderator role checks in joinEvent.
Description check		The description directly explains the authorization bug, the 403 behavior, the refactoring, and the added integration tests.

✨ Finishing Touches

🧪 Generate unit tests (beta)

🤖 Coding Agent task started for unit test generation.

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit checks the joining gate
No host token slips through by fate
A moderator request is checked
The denied path earns due respect
Two tests hop in to guard the route
And keep unauthorized tokens out}

_{Comment @coderabbitai help to get the list of available commands.}

iamitprakash

PR template is not as per standard, please update

prakashchoudhary07 · 2026-10-13T19:06:11Z

+    it("should return 403 and no token when a super user without member role requests the moderator role", function (done) {
+      service = sinon.stub(EventAPIService.prototype, "get").returns({ data: [event1Data] });


When is a super_user not a member?
Can there be a super user without a member role?

super_user and member are separate flags in user.roles, and nothing sets member automatically when someone gets super_user.

yes

This needs to be looked at. Need to get the confirmation once. Let's track this separately, please

Sure, created #2660 to track this. I've kept the test as is for now since it reflects the current behaviour; will update it based on the outcome of the issue.

prakashchoudhary07 · 2026-10-13T19:07:42Z

Need to check this part: how the event codes are retrieved

REF: #2658

Created an issue for it; can look into it later

prakashchoudhary07 · 2026-10-13T19:19:42Z

@@ -143,6 +143,10 @@
          message: "Token generated successfully!",
        });


NIT: Also, see if we can simplify this part, it's confusing

simplified.

prakashchoudhary07 · 2026-10-13T19:19:45Z

+
+      return res.status(403).json({
+        message: "Unauthorized, you don't have permission to join as host or moderator!",
+      });


If we want to make a member a host, is that possible currently

No. Host requires super_user in both the UI and the API.

geekyvaishnavi · 2026-10-13T20:02:32Z

PR template is not as per standard, please update

Updated the PR template

…or join

coderabbitai · 2026-10-15T10:39:51Z

Note

Unit test generation is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Generating unit tests... This may take up to 20 minutes.

coderabbitai · 2026-10-15T10:39:55Z

🤖 Coding Agent task started for unit test generation.

ankushdharkar · 2026-10-15T11:40:18Z

-        return res.status(201).json({
-          token,
-          message: "Token generated successfully!",
+      if (!hasPermission) {


This makes it sound like if no permission, then don't allow token creation.
But later, we do create tokens.

Like we discussed, please clean up that rather long and confusing if block using simplified guard clauses @geekyvaishnavi

Removed hasPermission and replaced the nested block with guard clauses.

…nEvent

prakashchoudhary07 · 2026-10-17T02:50:24Z

    }

-    const token = tokenService.getAuthToken({ ...payload, roomId });
+    const token = tokenService.getAuthToken({ userId, role, roomId });


Can users with other roles get a token?
Can new users get the token?

No. The validator only accepts host, moderator, guest and maven. Any other role gets a 400 before it reaches the controller.

Not as host or moderator. A new user (first-time signup) has only { archived: false, in_discord: false } and no member or super_user role, so authorizeRoles blocks them on /join-admin. Like anyone else, they can only join as a guest, or as a maven with a valid event code.

What happens if the role is "guest" ?

guest skips all the role checks and gets a token directly

What is the expected behaviour for a guest?

A guest is the open role, so anyone can join an event as a guest without logging in. That's why there's no check they get a token straight away with role "guest", which only gives them guest-level access in the room.

geekyvaishnavi added 2 commits October 7, 2026 23:54

fix(events): return 403 when user lacks role to join as host or moder…

cdc1c9d

…ator

test(events): verify join-admin rejects host/moderator without requir…

86915d7

…ed role

geekyvaishnavi marked this pull request as draft October 12, 2026 12:29

Merge branch 'develop' into fix/join-admin-host-role-check

c720650

geekyvaishnavi marked this pull request as ready for review October 13, 2026 03:06

iamitprakash requested changes Oct 13, 2026

View reviewed changes

prakashchoudhary07 requested changes Oct 13, 2026

View reviewed changes

refactor(events): simplify role checks in joinEvent

a12c6f2

geekyvaishnavi requested review from iamitprakash and prakashchoudhary07 October 13, 2026 20:31

geekyvaishnavi marked this pull request as draft October 14, 2026 19:42

refactor(events): refactor joinEvent function

e0918f1

geekyvaishnavi changed the title ~~Fix/join admin host role check~~ fix(events): enforce role checks for host and moderator in joinEvent Oct 15, 2026

geekyvaishnavi marked this pull request as ready for review October 15, 2026 09:52

test(events): cover maven event code and unauthenticated host/moderat…

e52f092

…or join

ankushdharkar requested changes Oct 15, 2026

View reviewed changes

refactor(events): replace nested role check with guard clauses in joi…

4f2ae3c

…nEvent

ankushdharkar reviewed Oct 15, 2026

View reviewed changes

Comment thread controllers/events.js

ankushdharkar reviewed Oct 15, 2026

View reviewed changes

Comment thread controllers/events.js

refactor(events): safely destructure user roles in joinEvent

856b175

geekyvaishnavi requested a review from ankushdharkar October 16, 2026 07:37

iamitprakash requested changes Oct 16, 2026

View reviewed changes

Comment thread test/integration/events.test.js

Comment thread test/integration/events.test.js

Comment thread controllers/events.js

geekyvaishnavi added 2 commits October 16, 2026 22:52

refactor(events): use role-specific 403 messages in joinEvent

03b3336

test(events): assert token payload in joinEvent success cases

2ee56e7

geekyvaishnavi requested a review from iamitprakash October 16, 2026 18:16

iamitprakash approved these changes Oct 16, 2026

View reviewed changes

This was referenced Oct 16, 2026

[Bug]: "Join the Event" card shows roles the user isn't allowed to join as RealDevSquad/website-www#1184

Open

[Feature]: Use res.boom for error responses in events controller #2659

Open

prakashchoudhary07 requested changes Oct 17, 2026

View reviewed changes

geekyvaishnavi mentioned this pull request Oct 17, 2026

Confirm whether super_user without member role should be allowed to join as moderator #2660

Open

geekyvaishnavi requested a review from prakashchoudhary07 October 17, 2026 16:50

prakashchoudhary07 approved these changes Oct 19, 2026

View reviewed changes

Merge branch 'develop' into fix/join-admin-host-role-check

ea744b4

prakashchoudhary07 merged commit 0fe950e into RealDevSquad:develop Oct 19, 2026
4 checks passed

This was referenced Oct 19, 2026

Dev To Main Sync #2661

Merged

Production Testing: joinEvent Role Checks #2662

Open

prakashchoudhary07 mentioned this pull request Oct 22, 2026

fix(security): bump Node.js runtime to 26.12.1 #2663

Open

2 of 5 tasks

		it("should return 403 and no token when a super user without member role requests the moderator role", function (done) {
		service = sinon.stub(EventAPIService.prototype, "get").returns({ data: [event1Data] });

		@@ -143,6 +143,10 @@
		message: "Token generated successfully!",
		});

Conversation

geekyvaishnavi commented Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue Ticket Number

Tech Doc Link

Business Doc Link

Description

Checklist

Screenshots

Test Coverage

Additional Notes

Uh oh!

coderabbitai Bot commented Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

iamitprakash left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

geekyvaishnavi Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

prakashchoudhary07 Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

geekyvaishnavi Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

geekyvaishnavi commented Oct 13, 2026

Uh oh!

coderabbitai Bot commented Oct 15, 2026

Uh oh!

coderabbitai Bot commented Oct 15, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

geekyvaishnavi commented Oct 11, 2026 •

edited

Loading

coderabbitai Bot commented Oct 11, 2026 •

edited

Loading

iamitprakash left a comment •

edited

Loading

geekyvaishnavi Oct 13, 2026 •

edited

Loading

prakashchoudhary07 Oct 13, 2026 •

edited

Loading

geekyvaishnavi Oct 13, 2026 •

edited

Loading