fix(remixer): add project-level access check to tree endpoint

Author: jakeaturner

server/api/remixer.ts

@@ -588,6 +588,12 @@ const getRemixerPageTree = async (
 ) => {
   try {
     const { subdomain, path, flatten } = req.body;
+
+    const ctx = await ProjectContext.load(req.params.id);
+    if (!ctx.canMember(req.user)) {
+      return returnProjectError(res, new ProjectError("unauthorized"));
+    }
+
     const bookService = new BookService({
       bookID: `${subdomain}-${path}`,
     });
@@ -597,6 +603,10 @@ const getRemixerPageTree = async (
       response: tree,
     });
   } catch (error) {
+    if (error instanceof ProjectError) {
+      return returnProjectError(res, error);
+    }
+
     debug("[remixer] getRemixerPageTree unexpected error:", error);
     return conductor500Err(res);
   }

server/api/services/book-service.ts

@@ -267,10 +267,16 @@ export default class BookService {
         method: "GET",
       },
     });
+    
     if (!res.ok) {
       throw new Error(`Error fetching tree: ${res.statusText}`);
     }
+    
     const rawTree = (await res.json()) as GetPageSubPagesResponse;
+    if(!rawTree?.page) {
+      throw new Error("No page data found in tree response");
+    }
+
     const structured = this._buildHierarchy(rawTree?.page);
 
     if (flatten) {