buggood first issueneeds triage
仓库指标
- 星标
- (12,181 个星标)
- PR 合并指标
- (30 天内没有已合并 PR)
描述
Prerequisites
- Are you running the latest version?
- Are you able to consistently reproduce the issue?
- Did you search the issue queue for existing issue? Search issues
Issue Description
The surcharges query in api-plugin-surcharges is missing the read permission validation.
https://github.com/reactioncommerce/reaction/blob/b11e47f05a3d3042b76385e992960dfafb36a286/packages/api-plugin-surcharges/src/queries/surcharges.js#L15
This means every user can query the surcharges regardless the permission they have.
Possible Solution
An example of a query that has the desired permission validation. https://github.com/reactioncommerce/reaction/blob/b11e47f05a3d3042b76385e992960dfafb36a286/packages/api-plugin-accounts/src/queries/groups.js#L14