put behind read permissions

HHS · Jul 15, 2024 · 440a55a · 440a55a
1 parent 0ef613c
commit 440a55a
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/src/routes/activityReports/handlers.js b/src/routes/activityReports/handlers.js
@@ -725,6 +725,17 @@ export async function getActivityRecipients(req, res) {
 export async function getActivityRecipientsForExistingReport(req, res) {
   const { region } = req.query;
   const { activityReportId } = req.params;
+
+  const [report] = await activityReportAndRecipientsById(req.params.activityReportId);
+  const userId = await currentUserId(req, res);
+  const user = await userById(userId);
+  const authorization = new ActivityReport(user, report);
+
+  if (!authorization.canGet()) {
+    res.sendStatus(403);
+    return;
+  }
+
   const targetRegion = parseInt(region, DECIMAL_BASE);
   const activityRecipients = await possibleRecipients(targetRegion, activityReportId);
   res.json(activityRecipients);