Fix IDOR for segment

src/app/api/websites/[websiteId]/segments/[segmentId]/route.ts

@@ -3,7 +3,7 @@ import { parseRequest } from '@/lib/request';
 import { json, notFound, ok, unauthorized } from '@/lib/response';
 import { anyObjectParam, segmentTypeParam } from '@/lib/schema';
 import { canDeleteWebsite, canUpdateWebsite, canViewWebsite } from '@/permissions';
-import { deleteSegment, getSegment, updateSegment } from '@/queries/prisma';
+import { deleteSegment, getWebsiteSegment, updateSegment } from '@/queries/prisma';
 
 export async function GET(
   request: Request,
@@ -17,12 +17,16 @@ export async function GET(
 
   const { websiteId, segmentId } = await params;
 
-  const segment = await getSegment(segmentId);
-
-  if (websiteId && !(await canViewWebsite(auth, websiteId))) {
+  if (!(await canViewWebsite(auth, websiteId))) {
     return unauthorized();
   }
 
+  const segment = await getWebsiteSegment(websiteId, segmentId);
+
+  if (!segment) {
+    return notFound();
+  }
+
   return json(segment);
 }
 
@@ -45,16 +49,16 @@ export async function POST(
   const { websiteId, segmentId } = await params;
   const { type, name, parameters } = body;
 
-  const segment = await getSegment(segmentId);
+  if (!(await canUpdateWebsite(auth, websiteId))) {
+    return unauthorized();
+  }
+
+  const segment = await getWebsiteSegment(websiteId, segmentId);
 
   if (!segment) {
     return notFound();
   }
 
-  if (!(await canUpdateWebsite(auth, websiteId))) {
-    return unauthorized();
-  }
-
   const result = await updateSegment(segmentId, {
     type,
     name,
@@ -76,16 +80,16 @@ export async function DELETE(
 
   const { websiteId, segmentId } = await params;
 
-  const segment = await getSegment(segmentId);
+  if (!(await canDeleteWebsite(auth, websiteId))) {
+    return unauthorized();
+  }
+
+  const segment = await getWebsiteSegment(websiteId, segmentId);
 
   if (!segment) {
     return notFound();
   }
 
-  if (!(await canDeleteWebsite(auth, websiteId))) {
-    return unauthorized();
-  }
-
   await deleteSegment(segmentId);
 
   return ok();