As a non-admin user, I shouldn't be able to delete another user's board about cboard-api HOT 6 OPEN

Hello @sylvansson . Sorry, I had some problems trying to reproduce the environment because of all the API keys needed. Yes, you can assign this to someone else

from cboard-api.

@martinbedouret This might be a good task for Katerina and Maria? I know it's security-related but it should be fairly simple, and I wrote some tests in #174 so they can validate that the fix works as intended.

from cboard-api.

Just in case, I'm completely new to this app and api (and a beginner dev), but I realized that the same problem should happen with deleting a user?
removeUser is almost identical with deleteBoard, both not considering the user and going straight to findByIdAndRemove

from cboard-api.

Hi @callapa1, good observation. I would have to check, but as far as I know only an admin can call the removeUser route. It's a bit hidden but you can see it in the Swagger definition for the route.

from cboard-api.

Hi @sylvansson . Yes, I just found it. Only admin in x-security-scopes

from cboard-api.

Hi @callapa1, are you still working on this? If not, I might assign the issue to someone else.

from cboard-api.