Harden endpoint by restricting to public accesses

2 weeks ago · 82a176ded6
1 changed files with 4 additions and 1 deletions
--- a/apps/api/src/app/endpoints/public/public.controller.ts
+++ b/apps/api/src/app/endpoints/public/public.controller.ts
@ -46,7 +46,10 @@ export class PublicController {
  public async getPublicPortfolio(
    @Param('accessId') accessId: string
  ): Promise<PublicPortfolioResponse> {
-    const access = await this.accessService.access({ id: accessId });
+    const access = await this.accessService.access({
+      granteeUserId: null,
+      id: accessId
+    });

    if (!access) {
      throw new HttpException(