add owner authorization checks to bookmark-folder API

apps/app/src/server/models/bookmark-folder.ts

@@ -26,6 +26,10 @@ export interface BookmarkFolderDocument extends Document {
 
 export interface BookmarkFolderModel extends Model<BookmarkFolderDocument> {
   createByParameters(params: IBookmarkFolder): Promise<BookmarkFolderDocument>;
+  findByIdAndOwner(
+    bookmarkFolderId: Types.ObjectId | string,
+    ownerId: Types.ObjectId | string,
+  ): Promise<{ folder: BookmarkFolderDocument | null; isOwner: boolean }>;
   deleteFolderAndChildren(
     bookmarkFolderId: Types.ObjectId | string,
   ): Promise<{ deletedCount: number }>;
@@ -113,6 +117,18 @@ bookmarkFolderSchema.statics.createByParameters = async function (
   return bookmarkFolder;
 };
 
+bookmarkFolderSchema.statics.findByIdAndOwner = async function (
+  bookmarkFolderId: Types.ObjectId | string,
+  ownerId: Types.ObjectId | string,
+): Promise<{ folder: BookmarkFolderDocument | null; isOwner: boolean }> {
+  const folder = await this.findById(bookmarkFolderId);
+  if (folder == null) {
+    return { folder: null, isOwner: false };
+  }
+  const isOwner = folder.owner.toString() === ownerId.toString();
+  return { folder, isOwner };
+};
+
 bookmarkFolderSchema.statics.deleteFolderAndChildren = async function (
   bookmarkFolderId: Types.ObjectId | string,
 ): Promise<{ deletedCount: number }> {

apps/app/src/server/routes/apiv3/bookmark-folder.ts

@@ -344,11 +344,14 @@ module.exports = (crowi: Crowi) => {
     async (req, res) => {
       const { id } = req.params;
       try {
-        const folder = await BookmarkFolder.findById(id);
+        const { folder, isOwner } = await BookmarkFolder.findByIdAndOwner(
+          id,
+          req.user._id,
+        );
         if (folder == null) {
           return res.apiv3Err('bookmark_folder_not_found', 404);
         }
-        if (folder.owner.toString() !== req.user._id.toString()) {
+        if (!isOwner) {
           return res.apiv3Err('forbidden', 403);
         }
         const result = await BookmarkFolder.deleteFolderAndChildren(id);