From bef4c4cba2a4c1026b5fc1627f1062610d59e558 Mon Sep 17 00:00:00 2001
From: Aditya8369 <mahajan2005aditya@gmail.com>
Date: Tue, 2 Jun 2026 10:26:16 +0530
Subject: [PATCH 1/2] [BUG]: Owner message recipient resolution can send
 incorrect recipientId

---
 frontend/src/components/ReferralDetail.jsx | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/frontend/src/components/ReferralDetail.jsx b/frontend/src/components/ReferralDetail.jsx
index faa2a28..31c74f8 100644
--- a/frontend/src/components/ReferralDetail.jsx
+++ b/frontend/src/components/ReferralDetail.jsx
@@ -65,14 +65,15 @@ const ReferralDetail = () => {
       return;
     }
 
-    if (isOwner && applicants.length > 0 && !selectedRecipientId) {
-      setSelectedRecipientId(getDocId(applicants[0].user));
+    if (isOwner) {
+      if (applicants.length > 0 && !selectedRecipientId) {
+        setSelectedRecipientId(getDocId(applicants[0].user));
+      }
+      return;
     }
 
-    if (!isOwner) {
-      setSelectedRecipientId(getDocId(referral.postedBy));
-    }
-  }, [referral, applicants, isOwner, selectedRecipientId]);
+    setSelectedRecipientId(getDocId(referral.postedBy));
+  }, [referral, applicants, isOwner]);
 
   const fetchReferral = async () => {
     try {
@@ -487,7 +488,7 @@ const ReferralDetail = () => {
 
                     <button
                       type="submit"
-                      disabled={sendingMessage}
+                      disabled={sendingMessage || (isOwner && !selectedRecipientId)}
                       className="inline-flex items-center justify-center rounded-xl bg-blue-600 px-5 py-3 font-semibold text-white shadow-lg transition-colors hover:bg-blue-700 disabled:cursor-not-allowed disabled:opacity-50"
                     >
                       {sendingMessage ? 'Sending...' : 'Send Message'}

From 6799780a0a1e57ada9b9e5d7ac3d43577a3680c0 Mon Sep 17 00:00:00 2001
From: Aditya8369 <mahajan2005aditya@gmail.com>
Date: Tue, 2 Jun 2026 10:33:44 +0530
Subject: [PATCH 2/2] [BUG]: Referral route auth middleware mismatch

---
 backend/controllers/referral.controller.js | 25 ++++++++++++----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/backend/controllers/referral.controller.js b/backend/controllers/referral.controller.js
index 96c657d..f2bf630 100644
--- a/backend/controllers/referral.controller.js
+++ b/backend/controllers/referral.controller.js
@@ -394,20 +394,21 @@ async function rejectReferral(req, res, next) {
 // Get single referral by ID
 async function getReferralById(req, res, next) {
   try {
-    const referral = await JobReferral.findById(req.params.id)
-      .populate('postedBy', 'name email alumnus_bio type referralPostingSuspended referralPostingSuspendedReason')
-      .populate('applicants.user', 'name email alumnus_bio');
-    
+    const { referral, access } = await getReferralAccess(req.params.id, req.user.id);
+
     if (!referral) {
       return res.status(404).json({ message: 'Referral not found' });
     }
 
-    const currentUser = req.user?.id ? await getCurrentUserSummary(req.user.id) : null;
-    const isOwner = referral.postedBy?._id?.toString() === req.user?.id;
-    if (isReferralHidden(referral) && currentUser?.type !== 'admin' && !isOwner) {
+    if (!access) {
+      // Do not leak referral existence.
       return res.status(404).json({ message: 'Referral not found' });
     }
 
+    // Keep response structure consistent with prior implementation.
+    await referral.populate('postedBy', 'name email alumnus_bio type referralPostingSuspended referralPostingSuspendedReason');
+    await referral.populate('applicants.user', 'name email alumnus_bio');
+
     res.json(referral);
   } catch (err) {
     next(err);
@@ -416,14 +417,14 @@ async function getReferralById(req, res, next) {
 
 async function getReferralTimeline(req, res, next) {
   try {
-    const referral = await JobReferral.findById(req.params.id).select('timeline moderation postedBy');
+    const { referral, access } = await getReferralAccess(req.params.id, req.user.id);
+
     if (!referral) {
       return res.status(404).json({ message: 'Referral not found' });
     }
 
-    const currentUser = req.user?.id ? await getCurrentUserSummary(req.user.id) : null;
-    const isOwner = referral.postedBy?.toString() === req.user?.id;
-    if (isReferralHidden(referral) && currentUser?.type !== 'admin' && !isOwner) {
+    if (!access) {
+      // Do not leak referral existence.
       return res.status(404).json({ message: 'Referral not found' });
     }
 
@@ -437,7 +438,9 @@ async function getReferralTimeline(req, res, next) {
   }
 }
 
+
 async function closeReferral(req, res, next) {
+
   try {
     const { id } = req.params;
     const currentUser = await getCurrentUserSummary(req.user.id);