Vulnerabilities in the Feeld dating app(fortbridge.co.uk)

    // auth.js
    export const checkParent = (permission, fn) => (parent, args, ctx) => {
      ctx.can(permission, parent); // CASL
      return fn(parent, args, ctx);
    };

    // resolvers.js
    import * as auth from './auth';
    export const resolvers = {
      // could also iterate over all the resolvers within User using Object.entries and apply auth.checkParent if you wanted
      User: {
        photoURLs: auth.checkParent('read', (parent, _, ctx) => {
          return parent.getSignedPhotoURLs();
        }),
      },
      Query: {
        user: async (_, { id }, ctx) => {
          const user = await ctx.db.users.getById(id);
          ctx.can('read', user);
          return user;
        },
      },
    };