Add: owner check to subscription endpoints

Author: tatevikg1

src/Subscription/Controller/SubscriberListController.php

@@ -176,7 +176,7 @@ public function getList(
             throw $this->createNotFoundException('Subscriber list not found.');
         }
 
-        $this->denyAccessUnlessOwnerOrPublic($list, $authUser);
+        $this->denyAccessUnlessOwner($list, $authUser);
 
         return $this->json($this->normalizer->normalize($list), Response::HTTP_OK);
     }
@@ -236,7 +236,7 @@ public function deleteList(
             throw $this->createNotFoundException('Subscriber list not found.');
         }
 
-        $this->denyAccessUnlessOwnerOrPublic($list, $authUser);
+        $this->denyAccessUnlessOwner($list, $authUser);
 
         $this->subscriberListManager->delete($list);
         $this->entityManager->flush();
@@ -356,7 +356,7 @@ public function updateList(
             throw $this->createNotFoundException('Subscriber list not found.');
         }
 
-        $this->denyAccessUnlessOwnerOrPublic($list, $authUser);
+        $this->denyAccessUnlessOwner($list, $authUser);
 
         /** @var CreateSubscriberListRequest $subscriberListRequest */
         $subscriberListRequest = $this->validator->validate($request, CreateSubscriberListRequest::class);
@@ -370,7 +370,7 @@ public function updateList(
         return $this->json($this->normalizer->normalize($data), Response::HTTP_OK);
     }
 
-    private function denyAccessUnlessOwnerOrPublic(SubscriberList $list, Administrator $user): void
+    private function denyAccessUnlessOwner(SubscriberList $list, Administrator $user): void
     {
         if ($list->getOwner() === null) {
             return;

src/Subscription/Controller/SubscriptionController.php

@@ -6,6 +6,7 @@
 
 use Doctrine\ORM\EntityManagerInterface;
 use OpenApi\Attributes as OA;
+use PhpList\Core\Domain\Identity\Model\Administrator;
 use PhpList\Core\Domain\Subscription\Model\SubscriberList;
 use PhpList\Core\Domain\Subscription\Service\Manager\SubscriptionManager;
 use PhpList\Core\Security\Authentication;
@@ -122,12 +123,14 @@ public function createSubscription(
         Request $request,
         #[MapEntity(mapping: ['listId' => 'id'])] ?SubscriberList $list = null,
     ): JsonResponse {
-        $this->requireAuthentication($request);
+        $authUser = $this->requireAuthentication($request);
 
         if (!$list) {
             throw $this->createNotFoundException('Subscriber list not found.');
         }
 
+        $this->denyAccessUnlessOwner($list, $authUser);
+
         /** @var SubscriptionRequest $subscriptionRequest */
         $subscriptionRequest = $this->validator->validate($request, SubscriptionRequest::class);
         $subscriptions = $this->subscriptionManager->createSubscriptions($list, $subscriptionRequest->emails);
@@ -188,10 +191,13 @@ public function deleteSubscriptions(
         Request $request,
         #[MapEntity(mapping: ['listId' => 'id'])] ?SubscriberList $list = null,
     ): JsonResponse {
-        $this->requireAuthentication($request);
+        $authUser = $this->requireAuthentication($request);
         if (!$list) {
             throw $this->createNotFoundException('Subscriber list not found.');
         }
+
+        $this->denyAccessUnlessOwner($list, $authUser);
+
         $subscriptionRequest = new SubscriptionRequest();
         $subscriptionRequest->emails = $request->query->all('emails');
 
@@ -202,4 +208,17 @@ public function deleteSubscriptions(
 
         return $this->json(null, Response::HTTP_NO_CONTENT);
     }
+
+    private function denyAccessUnlessOwner(SubscriberList $list, Administrator $user): void
+    {
+        if ($list->getOwner() === null) {
+            return;
+        }
+
+        if ($list->getOwner()->getId() === $user->getId()) {
+            return;
+        }
+
+        throw $this->createAccessDeniedException('Access denied.');
+    }
 }