Merge remote-tracking branch 'origin/develop' into issue-11067

# Conflicts:
#	backend/src/app/http/websocket.clj

Co-authored-by: niwinz <843689+niwinz@users.noreply.github.com>

backend/src/app/http/websocket.clj

@@ -180,7 +180,7 @@
                          :file-id file-id
                          :session-id session-id
                          :profile-id profile-id}]
-            (mbus/pub! msgbus
+           (mbus/pub! msgbus
                        :topic file-id
                        :message message)))
         (recur)))
@@ -226,12 +226,13 @@
 
 (defmethod handle-message :pointer-update
   [{:keys [::mbus/msgbus]} {:keys [::ws/state ::session-id ::profile-id]} {:keys [file-id] :as message}]
-  (when (::file-subscription @state)
-    (let [message (-> message
-                      (assoc :subs-id file-id)
-                      (assoc :profile-id profile-id)
-                      (assoc :session-id session-id))]
-      (mbus/pub! msgbus :topic file-id :message message))))
+  (when-let [subs (::file-subscription @state)]
+    (when (= file-id (:file-id subs))
+      (let [message (-> message
+                        (assoc :subs-id file-id)
+                        (assoc :profile-id profile-id)
+                        (assoc :session-id session-id))]
+        (mbus/pub! msgbus :topic file-id :message message)))))
 
 (defmethod handle-message :default
   [_ {:keys [::ws/id]} message]

backend/test/backend_tests/http_websocket_test.clj

@@ -0,0 +1,102 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS INC Sucursal en España SL
+
+(ns backend-tests.http-websocket-test
+  (:require
+   [app.common.uuid :as uuid]
+   [app.db :as db]
+   [app.http.websocket :as ws]
+   [app.msgbus :as mbus]
+   [app.rpc :as-alias rpc]
+   [app.rpc.commands.files :as files]
+   [app.rpc.commands.teams :as teams]
+   [app.util.websocket :as util-ws]
+   [backend-tests.helpers :as th]
+   [clojure.test :as t]
+   [promesa.exec.csp :as sp]))
+
+(t/use-fixtures :once th/state-init)
+(t/use-fixtures :each th/database-reset)
+
+(defn make-wsp
+  [profile-id state output-ch]
+  {::util-ws/id (uuid/next)
+   ::util-ws/state state
+   ::util-ws/output-ch output-ch
+   ::ws/profile-id profile-id
+   ::ws/session-id (uuid/next)})
+
+(t/deftest subscribe-file-permission-check
+  (let [profile1 (th/create-profile* 1 {:is-active true})
+        profile2 (th/create-profile* 2 {:is-active true})
+        file     (th/create-file* 1 {:profile-id (:id profile1)
+                                     :project-id (:default-project-id profile1)})
+        cfg      th/*system*
+        state    (atom {})
+        output-ch (sp/chan :buf (sp/dropping-buffer 64))]
+
+    (t/testing "rejects unauthorized user"
+      (let [wsp (make-wsp (:id profile2) state output-ch)]
+        (t/is (thrown-with-msg?
+               clojure.lang.ExceptionInfo
+               #"not found"
+               ((get-method ws/handle-message :subscribe-file)
+                cfg wsp {:file-id (:id file)})))))
+
+    (t/testing "permission check passes for authorized user"
+      (t/is (nil? (files/check-read-permissions! cfg (:id profile1) (:id file)))))))
+
+(t/deftest subscribe-team-permission-check
+  (let [profile1 (th/create-profile* 1 {:is-active true})
+        profile2 (th/create-profile* 2 {:is-active true})
+        team     (th/create-team* 1 {:profile-id (:id profile1)})
+        cfg      th/*system*
+        state    (atom {})
+        output-ch (sp/chan :buf (sp/dropping-buffer 64))]
+
+    (t/testing "rejects unauthorized user"
+      (let [wsp (make-wsp (:id profile2) state output-ch)]
+        (t/is (thrown-with-msg?
+               clojure.lang.ExceptionInfo
+               #"not found"
+               ((get-method ws/handle-message :subscribe-team)
+                cfg wsp {:team-id (:id team)})))))
+
+    (t/testing "permission check passes for authorized user"
+      (t/is (nil? (teams/check-read-permissions! cfg (:id profile1) (:id team)))))))
+
+(t/deftest pointer-update-validates-file-id
+  (let [profile  (th/create-profile* 1 {:is-active true})
+        file     (th/create-file* 1 {:profile-id (:id profile)
+                                     :project-id (:default-project-id profile)})
+        cfg      th/*system*
+        file-id  (:id file)
+        sub-ch   (sp/chan :buf (sp/dropping-buffer 64))
+        state    (atom {::ws/file-subscription {:file-id file-id
+                                                :channel sub-ch
+                                                :topic file-id}})
+        output-ch (sp/chan :buf (sp/dropping-buffer 64))
+        wsp      (make-wsp (:id profile) state output-ch)]
+
+    (t/testing "skips publish when file-id does not match subscription"
+      (let [wrong-msg {:type :pointer-update
+                       :file-id (uuid/next)
+                       :position {:x 10 :y 20}
+                       :zoom 1.0}]
+        (t/is (nil?
+               ((get-method ws/handle-message :pointer-update)
+                cfg wsp wrong-msg)))))
+
+    (t/testing "does nothing when no file subscription exists"
+      (let [empty-state (atom {})
+            empty-wsp   (make-wsp (:id profile) empty-state output-ch)
+            msg         {:type :pointer-update
+                         :file-id file-id
+                         :position {:x 10 :y 20}
+                         :zoom 1.0}]
+        (t/is (nil?
+               ((get-method ws/handle-message :pointer-update)
+                cfg empty-wsp msg)))))))