Update permissions for time tracking endpoints

changelogs/unreleased/security-fix-time-tracking-permissions-api.yml

+---
+title: Update permissions for time tracking endpoints
+merge_request:
+author:
+type: security

lib/api/time_tracking_endpoints.rb

@@ -14,8 +14,8 @@ module API
           "#{issuable_name}_iid".to_sym
         end
 
-        def update_issuable_key
-          "update_#{issuable_name}".to_sym
+        def admin_issuable_key
+          "admin_#{issuable_name}".to_sym
         end
 
         def read_issuable_key
@@ -60,7 +60,7 @@ module API
         requires :duration, type: String, desc: 'The duration to be parsed'
       end
       post ":id/#{issuable_collection_name}/:#{issuable_key}/time_estimate" do
-        authorize! update_issuable_key, load_issuable
+        authorize! admin_issuable_key, load_issuable
 
         status :ok
         update_issuable(time_estimate: Gitlab::TimeTrackingFormatter.parse(params.delete(:duration)))
@@ -71,7 +71,7 @@ module API
         requires issuable_key, type: Integer, desc: "The ID of a project #{issuable_name}"
       end
       post ":id/#{issuable_collection_name}/:#{issuable_key}/reset_time_estimate" do
-        authorize! update_issuable_key, load_issuable
+        authorize! admin_issuable_key, load_issuable
 
         status :ok
         update_issuable(time_estimate: 0)
@@ -83,7 +83,7 @@ module API
         requires :duration, type: String, desc: 'The duration to be parsed'
       end
       post ":id/#{issuable_collection_name}/:#{issuable_key}/add_spent_time" do
-        authorize! update_issuable_key, load_issuable
+        authorize! admin_issuable_key, load_issuable
 
         update_issuable(spend_time: {
           duration: Gitlab::TimeTrackingFormatter.parse(params.delete(:duration)),
@@ -96,7 +96,7 @@ module API
         requires issuable_key, type: Integer, desc: "The ID of a project #{issuable_name}"
       end
       post ":id/#{issuable_collection_name}/:#{issuable_key}/reset_spent_time" do
-        authorize! update_issuable_key, load_issuable
+        authorize! admin_issuable_key, load_issuable
 
         status :ok
         update_issuable(spend_time: { duration: :reset, user_id: current_user.id })

spec/support/shared_examples/requests/api/time_tracking_shared_examples.rb

@@ -4,6 +4,16 @@ RSpec.shared_examples 'an unauthorized API user' do
   it { is_expected.to eq(403) }
 end
 
+RSpec.shared_examples 'API user with insufficient permissions' do
+  context 'with non member that is the author' do
+    before do
+      issuable.update!(author: non_member) # an external author can't admin issuable
+    end
+
+    it_behaves_like 'an unauthorized API user'
+  end
+end
+
 RSpec.shared_examples 'time tracking endpoints' do |issuable_name|
   let(:non_member) { create(:user) }
 
@@ -14,6 +24,7 @@ RSpec.shared_examples 'time tracking endpoints' do |issuable_name|
       subject { post(api("/projects/#{project.id}/#{issuable_collection_name}/#{issuable.iid}/time_estimate", non_member), params: { duration: '1w' }) }
 
       it_behaves_like 'an unauthorized API user'
+      it_behaves_like 'API user with insufficient permissions'
     end
 
     it "sets the time estimate for #{issuable_name}" do
@@ -53,6 +64,7 @@ RSpec.shared_examples 'time tracking endpoints' do |issuable_name|
       subject { post(api("/projects/#{project.id}/#{issuable_collection_name}/#{issuable.iid}/reset_time_estimate", non_member)) }
 
       it_behaves_like 'an unauthorized API user'
+      it_behaves_like 'API user with insufficient permissions'
     end
 
     it "resets the time estimate for #{issuable_name}" do
@@ -70,6 +82,7 @@ RSpec.shared_examples 'time tracking endpoints' do |issuable_name|
       end
 
       it_behaves_like 'an unauthorized API user'
+      it_behaves_like 'API user with insufficient permissions'
     end
 
     it "add spent time for #{issuable_name}" do
@@ -119,6 +132,7 @@ RSpec.shared_examples 'time tracking endpoints' do |issuable_name|
       subject { post(api("/projects/#{project.id}/#{issuable_collection_name}/#{issuable.iid}/reset_spent_time", non_member)) }
 
       it_behaves_like 'an unauthorized API user'
+      it_behaves_like 'API user with insufficient permissions'
     end
 
     it "resets spent time for #{issuable_name}" do