fix: prevent mentees from self-approving via profileStatus (#727) - #760
Open
yingliu-data wants to merge 1 commit into
Open
fix: prevent mentees from self-approving via profileStatus (#727)#760yingliu-data wants to merge 1 commit into
yingliu-data wants to merge 1 commit into
Conversation
Mark Mentee.profileStatus as read-only for deserialization so a client cannot set or change their approval status through the public mentee registration payload. Status is now managed server-side (defaults to PENDING on creation, changed only via the admin approval flow), mirroring the existing protection on MentorDto. Closes #727
yingliu-data
requested review from
Sowmiya07,
Tooonia,
dricazenck,
goelsonali,
lauracabtay,
nora-weisser and
nverbic
July 4, 2026 10:54
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #727 — a mentee could set their own
profileStatus(e.g.ACTIVE) through the public registration endpoint, bypassing the admin approval queue.Mentee.profileStatuswas deserialized from the request body. This PR marks it read-only for deserialization, mirroring the existing protection already present onMentorDto.profileStatus:Jackson now ignores any client-supplied
profileStatus, so the field arrives asnull, and the mentee repository already defaultsnull→PENDINGon insert and preserves the existing server-side status on update. No other changes are required.Impact
PENDINGand appear in the admin approval queue (GET /mentees/pending), regardless of what the client sends.REJECTEDmentee can no longer reactivate themselves by resubmitting with"profileStatus": "ACTIVE"— the server-side status is preserved.Verification
Tested locally end-to-end against a Postgres-backed instance:
"profileStatus":"ACTIVE"ACTIVE(self-approved)PENDINGACTIVEACTIVEREJECTEDNotes
mentor_reviewingapplications #725 (rejecting a mentee does not cancel their applications) interacts with this: fixing bug: Rejecting a mentee does not cancelmentor_reviewingapplications #725 widens the path where the reactivation was reachable, which makes this fix more important.