chore: restrict CV access to session user and company users

Co-authored-by: Alexander Biraben-Renard <[email protected]>
imperial · Aug 21, 2024 · 43d54f4 · 43d54f4
1 parent e4beda8
commit 43d54f4
Showing 1 changed file with 14 additions and 6 deletions.
diff --git a/app/students/[shortcode]/page.tsx b/app/students/[shortcode]/page.tsx
@@ -94,12 +94,20 @@ const StudentProfilePage = async ({ params }: { params: { shortcode: string } })
             )}
 
             {studentProfile.cv && (
-              <Flex align="center" gap="2" asChild>
-                <Link href={`/api/uploads/${studentProfile.cv}`} target="_blank" underline="none">
-                  <BsFileEarmarkText title="download cv" color="black" />
-                  <Text>{studentProfile.user.name?.split(",").reverse()[0].trim()}&apos;s CV</Text>
-                </Link>
-              </Flex>
+              <RestrictedArea
+                showMessage={false}
+                allowedRoles={["COMPANY", "STUDENT"]}
+                additionalCheck={async session =>
+                  session.user.role === "COMPANY" || session.user.id === studentProfile.userId
+                }
+              >
+                <Flex align="center" gap="2" asChild>
+                  <Link href={`/api/uploads/${studentProfile.cv}`} target="_blank" underline="none">
+                    <BsFileEarmarkText title="download cv" color="var(--gray-12)" />
+                    <Text>{studentProfile.user.name?.split(",").reverse()[0].trim()}&apos;s CV</Text>
+                  </Link>
+                </Flex>
+              </RestrictedArea>
             )}
             <Flex align="center" gap="2">
               <BsEnvelope />