manohar/tia
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: notifications IDOR — verify child belongs to caller's family

Browse source 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Manohar Gupta 2026-05-17 11:57:57 +05:30
parent 389f66955c
commit 07bb149dd8
1 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/app/api/notifications/route.ts
View file

@ -1,5 +1,6 @@
import { NextResponse } from "next/server";
import { sql } from "@/db";
import { requireFamily, requireOwnership } from "@/lib/auth";
// IAP Vaccination Schedule (weeks from birth)
const IAP_SCHEDULE = [
@ -33,6 +34,9 @@ const IAP_SCHEDULE = [
export async function GET(request: Request) {
try {
const auth = await requireFamily();
if (!auth.success) return NextResponse.json({ error: auth.error }, { status: auth.status });
const { searchParams } = new URL(request.url);
const childId = searchParams.get("childId");
@ -40,6 +44,9 @@ export async function GET(request: Request) {
return NextResponse.json({ error: "childId required" }, { status: 400 });
}
const ownership = await requireOwnership(childId, "children", "Child");
if (!ownership.success) return NextResponse.json({ error: ownership.error }, { status: ownership.status });
// Get child's birth date
const children = await sql`
SELECT id, name, birth_date FROM children WHERE id = ${childId}