fix(progresses): enforce discord membership for progress updates

[Achintya-Chatterjee]

Date: December 11, 2025

Developer Name: @Achintya-Chatterjee

---

Issue Ticket Number

• Closes fix: Restrict /progresses POST endpoint to Discord members #2518

Description

• reject POST /progresses when roles.archived is true or roles.in_discord is not true
• centralise the Discord-member test fixture helper and re-use it across progress integration suites
• add regression test proving non-Discord users receive UNAUTHORIZED_WRITE

Documentation Updated?

• Yes
• No

Under Feature Flag

• Yes
• No

Database Changes

• Yes
• No

Breaking Changes

• Yes
• No

Development Tested?

• Yes
• No

Screenshots

Screenshot 1

Screen.Recording.2025-12-11.at.21.26.24.mp4

Test Coverage

Screenshot 1

Additional Notes

[coderabbitai]

Walkthrough

Authorization logic in createProgress endpoint strengthened to require non-archived status and Discord membership using optional chaining. Corresponding test files updated with a reusable withDiscordMembership helper to ensure test users meet the new authorization requirements.

Changes

Cohort / File(s)	Summary
Authorization logic updates controllers/progresses.js	Modified createProgress authorization to use optional chaining on req.userData.roles and forbid requests when archived is true or in_discord is not true, making checks stricter and null-safe.
Test setup and fixtures test/integration/progressesTasks.test.js, test/integration/progressesUsers.test.js	Introduced withDiscordMembership(user) helper function across both test files to augment user objects with archived: false and in_discord: true. Updated multiple test setup blocks to wrap user creation with this helper. Added new test case in progressesUsers.test.js validating 403 response when user is not in Discord.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

• Authorization logic change: Review the optional chaining implementation and new conditional guard in createProgress to ensure it correctly forbids unauthorized requests without unintended side effects.
• Test coverage alignment: Verify that the helper function is applied consistently across all test fixtures and that the new test case properly validates the 403 scenario for non-Discord users.

Possibly related PRs

• Restrict archived users to write progress of a task #2394: Adds UNAUTHORIZED_WRITE constant and in_discord guard logic to createProgress, directly related to this PR's authorization tightening.

Suggested reviewers

• AnujChhikara

Poem

🐰 With optional chains we safely check,
Discord membership kept in deck,
Archived flags are turned away,
Authorization tight each day!
✨ Tests aligned, the logic gleams—
Stronger controls in all our schemes!

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: enforcing Discord membership requirements for progress updates in the POST /progresses endpoint.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description check	✅ Passed	The pull request description clearly outlines the changes: enforcing Discord membership checks for the POST /progresses endpoint, centralizing test fixtures with a helper function, and adding regression tests.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/task-progress-API

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

📜 Review details

Configuration used: CodeRabbit UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 6b81a17 and f5fe2dc.

📒 Files selected for processing (3)

• controllers/progresses.js (1 hunks)
• test/integration/progressesTasks.test.js (6 hunks)
• test/integration/progressesUsers.test.js (7 hunks)

🧰 Additional context used

🧬 Code graph analysis (1)

test/integration/progressesUsers.test.js (2)

controllers/progresses.js (3)

• require (1-1)
• require (3-9)
• require (10-10)

test/integration/progressesTasks.test.js (3)

• require (11-15)
• require (19-19)
• withDiscordMembership (23-26)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: build (22.10.0)
• GitHub Check: Analyze (javascript)

🔇 Additional comments (6)

controllers/progresses.js (1)

49-51: Authorization logic correctly enforces Discord membership.

The check appropriately uses optional chaining on req.userData.roles and strictly validates both archived status and Discord membership. This prevents archived users and non-Discord members from creating progress updates.

Note: This assumes req.userData is always defined at this point (typically guaranteed by authentication middleware). If there's any path where req.userData could be undefined, consider adding optional chaining: req.userData?.roles?.archived.

test/integration/progressesUsers.test.js (3)

45-48: Good: Test fixtures updated to reflect Discord membership requirement.

Wrapping user fixtures with withDiscordMembership ensures tests reflect the new authorization requirements while maintaining existing test behavior.

---

166-184: Excellent regression test for non-Discord users.

The test correctly validates that users without Discord membership receive a 403 response. The unique username and github_id generation prevents fixture collisions.

---

193-195: Consistent test data setup across all test suites.

All test users are now properly configured with Discord membership, ensuring tests accurately reflect the production authorization requirements.

Also applies to: 298-299, 370-371, 453-454

test/integration/progressesTasks.test.js (2)

49-51: Good: Intentional omission of Discord membership for archived user test.

Line 50 correctly creates archivedUserId without withDiscordMembership, allowing the test at lines 178-192 to validate that archived or non-Discord users are properly blocked. This provides coverage for the archived status check in the authorization logic.

---

204-205: Consistent test fixture updates for Discord membership.

All test users in GET endpoint tests are now properly configured with Discord membership, aligning with the updated authorization requirements.

Also applies to: 401-401, 477-477, 564-564