From 43d54f4760808ebc896e6f0624ac854f3fa1b5dd Mon Sep 17 00:00:00 2001
From: Matthew Alex <matalex412@gmail.com>
Date: Wed, 21 Aug 2024 14:29:50 +0100
Subject: [PATCH] chore: restrict CV access to session user and company users

Co-authored-by: Alexander Biraben-Renard <ab1223@ic.ac.uk>
---
 app/students/[shortcode]/page.tsx | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/app/students/[shortcode]/page.tsx b/app/students/[shortcode]/page.tsx
index 323e65b4..9229a1c7 100644
--- a/app/students/[shortcode]/page.tsx
+++ b/app/students/[shortcode]/page.tsx
@@ -94,12 +94,20 @@ const StudentProfilePage = async ({ params }: { params: { shortcode: string } })
             )}
 
             {studentProfile.cv && (
-              <Flex align="center" gap="2" asChild>
-                <Link href={`/api/uploads/${studentProfile.cv}`} target="_blank" underline="none">
-                  <BsFileEarmarkText title="download cv" color="black" />
-                  <Text>{studentProfile.user.name?.split(",").reverse()[0].trim()}&apos;s CV</Text>
-                </Link>
-              </Flex>
+              <RestrictedArea
+                showMessage={false}
+                allowedRoles={["COMPANY", "STUDENT"]}
+                additionalCheck={async session =>
+                  session.user.role === "COMPANY" || session.user.id === studentProfile.userId
+                }
+              >
+                <Flex align="center" gap="2" asChild>
+                  <Link href={`/api/uploads/${studentProfile.cv}`} target="_blank" underline="none">
+                    <BsFileEarmarkText title="download cv" color="var(--gray-12)" />
+                    <Text>{studentProfile.user.name?.split(",").reverse()[0].trim()}&apos;s CV</Text>
+                  </Link>
+                </Flex>
+              </RestrictedArea>
             )}
             <Flex align="center" gap="2">
               <BsEnvelope />