From dad5970e8d464e2978ea285878d4a08f91fd13e7 Mon Sep 17 00:00:00 2001
From: aecsocket <43144841+aecsocket@users.noreply.github.com>
Date: Wed, 15 Jul 2026 15:38:08 +0100
Subject: [PATCH] fix: attribution list route permissions (#6731)

* fix: attribution list route permissions

* proper auth
---
 .../src/routes/internal/attribution.rs        | 35 +++++++++++++++----
 1 file changed, 29 insertions(+), 6 deletions(-)

diff --git a/apps/labrinth/src/routes/internal/attribution.rs b/apps/labrinth/src/routes/internal/attribution.rs
index 33ecc0e314..6e1af9e08b 100644
--- a/apps/labrinth/src/routes/internal/attribution.rs
+++ b/apps/labrinth/src/routes/internal/attribution.rs
@@ -6,7 +6,7 @@ use serde::{Deserialize, Serialize};
 use crate::auth::{check_is_moderator_from_headers, get_user_from_headers};
 use crate::database::PgPool;
 use crate::database::models::{
-    DBFileId, DBOrganization, DBTeamMember, DBVersion,
+    DBFileId, DBOrganization, DBProject, DBTeamMember, DBVersion,
     ids::{
         DBAttributionGroupId, DBProjectId, DBVersionId,
         generate_attribution_group_id,
@@ -312,16 +312,39 @@ pub async fn list(
     path: web::Path<ProjectId>,
 ) -> Result<web::Json<Vec<AttributionGroupResponse>>, ApiError> {
     let project_id: DBProjectId = path.into_inner().into();
-    let requester_is_mod = get_user_from_headers(
+    let user = get_user_from_headers(
         &req,
         &**pool,
         &redis,
         &session_queue,
-        Scopes::PROJECT_READ,
+        Scopes::VERSION_READ,
     )
-    .await
-    .ok()
-    .is_some_and(|(_, user)| user.role.is_mod());
+    .await?
+    .1;
+    let requester_is_mod = user.role.is_mod();
+
+    let project = DBProject::get_id(project_id, pool.as_ref(), redis.as_ref())
+        .await?
+        .ok_or(ApiError::NotFound)?;
+    let (team_member, organization_team_member) =
+        DBTeamMember::get_for_project_permissions(
+            &project.inner,
+            user.id.into(),
+            pool.as_ref(),
+        )
+        .await
+        .wrap_internal_err("failed to fetch project permissions")?;
+    if ProjectPermissions::get_permissions_by_role(
+        &user.role,
+        &team_member,
+        &organization_team_member,
+    )
+    .is_none()
+    {
+        return Err(ApiError::Auth(eyre!(
+            "you do not have permission to read versions for this project"
+        )));
+    }
 
     let groups = sqlx::query!(
         r#"