🗝️ fix: Enforce Skill Share Role Permission (#13062)

* fix: enforce skill share role permission

* fix: preserve share capability bypass

* refactor: move share policy middleware to api package

* style: order share middleware imports

* fix: satisfy share middleware type checks

* test: cover share policy resource types

api/server/middleware/checkSharePublicAccess.js

@@ -1,86 +1,8 @@
-const { logger } = require('@librechat/data-schemas');
-const { ResourceType, PermissionTypes, Permissions } = require('librechat-data-provider');
+const { createSharePolicyMiddleware } = require('@librechat/api');
+const { hasCapability } = require('~/server/middleware/roles/capabilities');
 const { getRoleByName } = require('~/models');
 
-/**
- * Maps resource types to their corresponding permission types
- */
-const resourceToPermissionType = {
-  [ResourceType.AGENT]: PermissionTypes.AGENTS,
-  [ResourceType.PROMPTGROUP]: PermissionTypes.PROMPTS,
-  [ResourceType.MCPSERVER]: PermissionTypes.MCP_SERVERS,
-  [ResourceType.REMOTE_AGENT]: PermissionTypes.REMOTE_AGENTS,
-  [ResourceType.SKILL]: PermissionTypes.SKILLS,
-};
-
-/**
- * Middleware to check if user has SHARE_PUBLIC permission for a resource type
- * Only enforced when request body contains `public: true`
- * @param {import('express').Request} req - Express request
- * @param {import('express').Response} res - Express response
- * @param {import('express').NextFunction} next - Express next function
- */
-const checkSharePublicAccess = async (req, res, next) => {
-  try {
-    const { public: isPublic } = req.body;
-
-    // Only check if trying to enable public sharing
-    if (!isPublic) {
-      return next();
-    }
-
-    const user = req.user;
-    if (!user || !user.role) {
-      return res.status(401).json({
-        error: 'Unauthorized',
-        message: 'Authentication required',
-      });
-    }
-
-    const { resourceType } = req.params;
-    const permissionType = resourceToPermissionType[resourceType];
-
-    if (!permissionType) {
-      return res.status(400).json({
-        error: 'Bad Request',
-        message: `Unsupported resource type for public sharing: ${resourceType}`,
-      });
-    }
-
-    const role = await getRoleByName(user.role);
-    if (!role || !role.permissions) {
-      return res.status(403).json({
-        error: 'Forbidden',
-        message: 'No permissions configured for user role',
-      });
-    }
-
-    const resourcePerms = role.permissions[permissionType] || {};
-    const canSharePublic = resourcePerms[Permissions.SHARE_PUBLIC] === true;
-
-    if (!canSharePublic) {
-      logger.warn(
-        `[checkSharePublicAccess][${user.id}] User denied SHARE_PUBLIC for ${resourceType}`,
-      );
-      return res.status(403).json({
-        error: 'Forbidden',
-        message: `You do not have permission to share ${resourceType} resources publicly`,
-      });
-    }
-
-    next();
-  } catch (error) {
-    logger.error(
-      `[checkSharePublicAccess][${req.user?.id}] Error checking SHARE_PUBLIC permission`,
-      error,
-    );
-    return res.status(500).json({
-      error: 'Internal Server Error',
-      message: 'Failed to check public sharing permissions',
-    });
-  }
-};
-
-module.exports = {
-  checkSharePublicAccess,
-};
+module.exports = createSharePolicyMiddleware({
+  getRoleByName,
+  hasCapability,
+});

api/server/middleware/checkSharePublicAccess.spec.js

@@ -1,8 +1,15 @@
-const { ResourceType, PermissionTypes, Permissions } = require('librechat-data-provider');
-const { checkSharePublicAccess } = require('./checkSharePublicAccess');
-const { getRoleByName } = require('~/models');
+jest.mock('~/models', () => ({
+  getRoleByName: jest.fn(),
+}));
 
-jest.mock('~/models');
+jest.mock('~/server/middleware/roles/capabilities', () => ({
+  hasCapability: jest.fn(),
+}));
+
+const { ResourceType, PermissionTypes, Permissions } = require('librechat-data-provider');
+const { hasCapability } = require('~/server/middleware/roles/capabilities');
+const { checkShareAccess, checkSharePublicAccess } = require('./checkSharePublicAccess');
+const { getRoleByName } = require('~/models');
 
 describe('checkSharePublicAccess middleware', () => {
   let mockReq;
@@ -11,6 +18,7 @@ describe('checkSharePublicAccess middleware', () => {
 
   beforeEach(() => {
     jest.clearAllMocks();
+    hasCapability.mockResolvedValue(false);
     mockReq = {
       user: { id: 'user123', role: 'USER' },
       params: { resourceType: ResourceType.AGENT },
@@ -162,3 +170,137 @@ describe('checkSharePublicAccess middleware', () => {
     });
   });
 });
+
+describe('checkShareAccess middleware', () => {
+  let mockReq;
+  let mockRes;
+  let mockNext;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    hasCapability.mockResolvedValue(false);
+    mockReq = {
+      user: { id: 'user123', role: 'USER' },
+      params: { resourceType: ResourceType.SKILL },
+      body: { updated: [] },
+    };
+    mockRes = {
+      status: jest.fn().mockReturnThis(),
+      json: jest.fn(),
+    };
+    mockNext = jest.fn();
+  });
+
+  it('should return 403 when user role has no SHARE permission for skills', async () => {
+    getRoleByName.mockResolvedValue({
+      permissions: {
+        [PermissionTypes.SKILLS]: {
+          [Permissions.SHARE]: false,
+          [Permissions.SHARE_PUBLIC]: false,
+        },
+      },
+    });
+
+    await checkShareAccess(mockReq, mockRes, mockNext);
+
+    expect(mockRes.status).toHaveBeenCalledWith(403);
+    expect(mockRes.json).toHaveBeenCalledWith({
+      error: 'Forbidden',
+      message: `You do not have permission to share ${ResourceType.SKILL} resources`,
+    });
+    expect(mockNext).not.toHaveBeenCalled();
+  });
+
+  it('should call next() when user has resource management capability for skills', async () => {
+    hasCapability.mockResolvedValue(true);
+
+    await checkShareAccess(mockReq, mockRes, mockNext);
+
+    expect(hasCapability).toHaveBeenCalledWith(mockReq.user, 'manage:skills');
+    expect(getRoleByName).not.toHaveBeenCalled();
+    expect(mockNext).toHaveBeenCalled();
+    expect(mockRes.status).not.toHaveBeenCalled();
+  });
+
+  it('should call next() when user role has SHARE permission for skills', async () => {
+    getRoleByName.mockResolvedValue({
+      permissions: {
+        [PermissionTypes.SKILLS]: {
+          [Permissions.SHARE]: true,
+          [Permissions.SHARE_PUBLIC]: false,
+        },
+      },
+    });
+
+    await checkShareAccess(mockReq, mockRes, mockNext);
+
+    expect(hasCapability).toHaveBeenCalledWith(mockReq.user, 'manage:skills');
+    expect(mockNext).toHaveBeenCalled();
+    expect(mockRes.status).not.toHaveBeenCalled();
+  });
+
+  it('should return 401 when user is not authenticated', async () => {
+    mockReq.user = null;
+
+    await checkShareAccess(mockReq, mockRes, mockNext);
+
+    expect(mockRes.status).toHaveBeenCalledWith(401);
+    expect(mockRes.json).toHaveBeenCalledWith({
+      error: 'Unauthorized',
+      message: 'Authentication required',
+    });
+    expect(mockNext).not.toHaveBeenCalled();
+  });
+
+  it('should return 400 for unsupported resource type', async () => {
+    mockReq.params = { resourceType: 'unsupported' };
+
+    await checkShareAccess(mockReq, mockRes, mockNext);
+
+    expect(mockRes.status).toHaveBeenCalledWith(400);
+    expect(mockRes.json).toHaveBeenCalledWith({
+      error: 'Bad Request',
+      message: 'Unsupported resource type for sharing: unsupported',
+    });
+  });
+
+  it('should return 403 when role has no permissions object', async () => {
+    getRoleByName.mockResolvedValue({ permissions: null });
+
+    await checkShareAccess(mockReq, mockRes, mockNext);
+
+    expect(mockRes.status).toHaveBeenCalledWith(403);
+    expect(mockNext).not.toHaveBeenCalled();
+  });
+
+  it('should return 500 on error', async () => {
+    getRoleByName.mockRejectedValue(new Error('Database error'));
+
+    await checkShareAccess(mockReq, mockRes, mockNext);
+
+    expect(mockRes.status).toHaveBeenCalledWith(500);
+    expect(mockRes.json).toHaveBeenCalledWith({
+      error: 'Internal Server Error',
+      message: 'Failed to check sharing permissions',
+    });
+  });
+
+  it('should reuse the role permission lookup for public sharing checks', async () => {
+    mockReq.body = { updated: [], public: true };
+    getRoleByName.mockResolvedValue({
+      permissions: {
+        [PermissionTypes.SKILLS]: {
+          [Permissions.SHARE]: true,
+          [Permissions.SHARE_PUBLIC]: true,
+        },
+      },
+    });
+
+    await checkShareAccess(mockReq, mockRes, mockNext);
+    await checkSharePublicAccess(mockReq, mockRes, mockNext);
+
+    expect(getRoleByName).toHaveBeenCalledTimes(1);
+    expect(mockNext).toHaveBeenCalledTimes(2);
+    expect(mockRes.status).not.toHaveBeenCalled();
+  });
+});