fix(api): group-scoped forms unreachable on public route
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- typescript
- Domain
- api, authorization
Research direction
Read packages/api/src/routes/forms.ts:38-42 and 92-99, then compare the events route's group-scope handling and spec §5.5. Run packages/api/src/routes/forms.test.ts and add coverage for group-scoped reads and submissions. Done means the behavior is fixed and tested, or the admin-only decision is documented in the spec.
Written by the indexing model from the issue text.
Description
Summary
GET /forms/:slug and POST /forms/:slug/submissions collapse scope='group' to the same handling as scope='staff_only' — only staff (systemTier >= 1) can read or submit. A group-scoped form should be visible to chairs/members of the attached group, not just staff.
Requirements
- Decide intentional or fix: per spec §5.5, group scope is "restricted to a specific group's members"
- If fixing: when
form.scope === 'group', plumb a group-membership check usingactor.chairedGroupIds+ a query forgroup_membershipsagainst the attached group_id - If intentional (admin-only by design), document in the spec
- Update tests in
packages/api/src/routes/forms.test.tsto cover the group-scoped path
Context
Surfaced in the Plan 4 review (PR #2011). The events route has parallel logic for group scope; forms should match.
Files
packages/api/src/routes/forms.ts:38-42, 92-99
- Dominant language
- HTML
- Stars
- 33
- Forks
- 104
- Avg merge
- 12h 3m
- Merged PRs (30d)
- 10
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from USRSE/usrse.github.io
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
USRSE/usrse.github.io#2001 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
USRSE/usrse.github.io#2000 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
USRSE/usrse.github.io#1991 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
USRSE/usrse.github.io#1948 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
USRSE/usrse.github.io#1947 · 1 comment ·
All issues in USRSE/usrse.github.io
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
use-agent-os/agent-os#3276 ·
-
good first issue refactor
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
[6.x]: "Cannot use object of type stdClass as array" loading Users index (regression of #19182) Open
Difficulty 1/5 Under an hour Newbie friendliness 90/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
-
area/sessions comp/agent P2 tool/skills type/perf
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
NousResearch/hermes-agent#117788 ·