[Bug][Blog][Angular] Comment identity is hardcoded — every comment posts as "Current User"/"current-user-id" (epic #705) #707

New Issue

2026-07-19T01:15:05Z

spikerj commented

2026-07-19 01:15:05 +00:00

Epic #705. blog-entry-component.ts addMainComment/addMediaComment send literal authorId: "current-user-id", authorName: "Current User" (~lines 201-202, 228-229 pre-#420). Real identity is available the same way the owner-delete gate gets it (keycloak.tokenParsed?.sub) or via ProfileService.getProfile() as blog-create does.

Server-side half: the comment endpoints (POST /posts/{id}/comments, /posts/{postId}/media/{mediaId}/comments) have no [Authorize] and trust the DTO — the same provenance hole backend #423 closed for post creation. Mirror that fix: [Authorize] + author fields from claims.

Also worth deciding: should anonymous viewers see the comment input at all (the /blog route is public)?

Epic #705. `blog-entry-component.ts` `addMainComment`/`addMediaComment` send literal `authorId: "current-user-id"`, `authorName: "Current User"` (~lines 201-202, 228-229 pre-#420). Real identity is available the same way the owner-delete gate gets it (`keycloak.tokenParsed?.sub`) or via `ProfileService.getProfile()` as blog-create does. **Server-side half:** the comment endpoints (`POST /posts/{id}/comments`, `/posts/{postId}/media/{mediaId}/comments`) have no `[Authorize]` and trust the DTO — the same provenance hole backend #423 closed for post creation. Mirror that fix: `[Authorize]` + author fields from claims. Also worth deciding: should anonymous viewers see the comment input at all (the `/blog` route is public)?

spikerj referenced this issue

2026-07-19 01:15:58 +00:00

[Security][Blog][Record] Create endpoints accepted spoofable client-supplied AuthorId — fixed by backend #423 (epic #705) #716

spikerj referenced this issue

2026-07-19 01:16:08 +00:00

[Epic][Blog][UX] Blog management & UX overhaul — findings from the 2026-07-18 full review #705

spikerj commented

2026-07-22 02:50:17 +00:00

Verified fixed and on master — both halves:

Angular (blog-entry-component.ts): addMainComment/addMediaComment now read the real identity from keycloak.tokenParsed?.sub (line ~97), not the literal "current-user-id"/"Current User". Covered by blog-entry-component.spec.ts ("the component only reads tokenParsed.sub"). Landed with the owner-delete work, angular PR #420.
Backend (BlogController): all comment endpoints are [Authorize] and set ActorId = callerId from the Keycloak claim (6 server-anchored sites on origin/master) — same fix pattern as post creation (#423 / #716).

The client-supplied author fields are no longer trusted; comments post under the authenticated user. Closing.

(The ticket's open question — whether anonymous viewers on the public /blog route should see the comment input at all — is a UX decision, not part of this identity bug; file separately if you still want to change that.)

Verified fixed and on `master` — both halves: - **Angular** (`blog-entry-component.ts`): `addMainComment`/`addMediaComment` now read the real identity from `keycloak.tokenParsed?.sub` (line ~97), not the literal `"current-user-id"`/`"Current User"`. Covered by `blog-entry-component.spec.ts` ("the component only reads tokenParsed.sub"). Landed with the owner-delete work, angular PR **#420**. - **Backend** (`BlogController`): all comment endpoints are `[Authorize]` and set `ActorId = callerId` from the Keycloak claim (6 server-anchored sites on `origin/master`) — same fix pattern as post creation (#423 / #716). The client-supplied author fields are no longer trusted; comments post under the authenticated user. Closing. (The ticket's open question — whether anonymous viewers on the public `/blog` route should see the comment input at all — is a UX decision, not part of this identity bug; file separately if you still want to change that.)

spikerj closed this issue

2026-07-22 02:50:20 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#707