Skip to content

fix(PM-4384) show respond to appeals only to logged in reviewers record #1543

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
hentrymartin wants to merge 1 commit into from
Closed

fix(PM-4384) show respond to appeals only to logged in reviewers record #1543

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 14 additions & 1 deletion src/apps/review/src/lib/components/TableAppealsResponse/TableAppealsResponse.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -426,6 +426,9 @@ export const TableAppealsResponse: FC<TableAppealsResponseProps> = (props: Table
renderer: (row: SubmissionReviewerRow) => {
const reviewDetail = row.aggregated?.reviews?.[row.reviewerIndex]
const reviewId = reviewDetail?.reviewInfo?.id ?? reviewDetail?.reviewId
const rowReviewerResourceId = reviewDetail?.resourceId ?? reviewDetail?.reviewInfo?.resourceId
const canRespondThisRow = isAdmin
Copy link
Copy Markdown

@github-actions github-actions Bot Mar 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ security]
The variable canRespondThisRow is calculated using the isAdmin flag and myReviewerResourceIds set. Ensure that myReviewerResourceIds is correctly populated and updated to reflect the current user's permissions, as any discrepancy could lead to incorrect access control.

|| (!!rowReviewerResourceId && myReviewerResourceIds.has(rowReviewerResourceId))

if (!reviewDetail || !reviewId) {
return (
Expand All @@ -447,6 +450,14 @@ export const TableAppealsResponse: FC<TableAppealsResponseProps> = (props: Table
)
}

if (!canRespondThisRow) {
Copy link
Copy Markdown

@github-actions github-actions Bot Mar 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ security]
The check for canRespondThisRow is crucial for determining if the 'Respond to Appeals' link is rendered. Ensure that this logic is thoroughly tested to prevent unauthorized access to the response functionality.

return (
<span className={styles.notReviewed}>
--
</span>
)
}

return (
<span className={styles.actionsCell}>
<span
Expand All @@ -457,7 +468,7 @@ export const TableAppealsResponse: FC<TableAppealsResponseProps> = (props: Table
>
<Link
className={styles.respondButton}
to={getReviewRoute(row.id, reviewId, canRespondToAppeals)}
to={getReviewRoute(row.id, reviewId, canRespondThisRow)}
>
Respond to Appeals
</Link>
Expand Down Expand Up @@ -504,6 +515,8 @@ export const TableAppealsResponse: FC<TableAppealsResponseProps> = (props: Table
hideHandleColumn,
canRespondToAppeals,
isAppealsResponsePhaseOpen,
isAdmin,
myReviewerResourceIds,
scoreVisibilityConfig,
Copy link

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The columns useMemo uses props.aiReviewers (to conditionally add the AI reviews expandable row), but props.aiReviewers is not included in the dependency array. This can leave the table columns stale if aiReviewers is loaded/updated after the initial render. Add props.aiReviewers (or a stable derived value) to the dependency list so the columns recompute when it changes.

Suggested change
scoreVisibilityConfig,
scoreVisibilityConfig,
props.aiReviewers,

Copilot uses AI. Check for mistakes.
])

Expand Down
Loading