andwati/dokploy
1
0
Fork 0
mirror of https://github.com/andwati/dokploy.git synced 2026-11-13 07:25:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor: inline the server org-scope check in each swarm handler

Browse Source 
Match the existing getContainerStats style instead of a shared helper.
This commit is contained in:
Mauricio Siu
2026-07-19 21:26:37 -06:00
parent 5563699f71
commit 182d3656bb
1 changed files with 36 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/dokploy/server/api/routers/swarm.ts
+36 -33
View File
@@ -11,23 +11,6 @@ import { z } from "zod";
import { createTRPCRouter, withPermission } from "../trpc"; import { createTRPCRouter, withPermission } from "../trpc";
import { containerIdRegex } from "./docker"; import { containerIdRegex } from "./docker";
// Ensures a caller-supplied serverId belongs to the caller's active
// organization before any Swarm read runs against it. Without this, the
// server-scoped read procedures were reachable cross-organization (IDOR).
const assertServerInActiveOrg = async (
serverId: string | undefined,
activeOrganizationId: string | undefined,
) => {
if (!serverId) return;
const server = await findServerById(serverId);
if (server.organizationId !== activeOrganizationId) {
throw new TRPCError({
code: "UNAUTHORIZED",
message: "You are not authorized to access this server",
});
}
};
export const swarmRouter = createTRPCRouter({ export const swarmRouter = createTRPCRouter({
getNodes: withPermission("server", "read") getNodes: withPermission("server", "read")
.input( .input(
@@ -36,19 +19,29 @@ export const swarmRouter = createTRPCRouter({
}), }),
) )
.query(async ({ input, ctx }) => { .query(async ({ input, ctx }) => {
await assertServerInActiveOrg( if (input.serverId) {
input.serverId, const server = await findServerById(input.serverId);
ctx.session?.activeOrganizationId, if (server.organizationId !== ctx.session?.activeOrganizationId) {
); throw new TRPCError({
code: "UNAUTHORIZED",
message: "You are not authorized to access this server",
});
}
}
return await getSwarmNodes(input.serverId); return await getSwarmNodes(input.serverId);
}), }),
getNodeInfo: withPermission("server", "read") getNodeInfo: withPermission("server", "read")
.input(z.object({ nodeId: z.string(), serverId: z.string().optional() })) .input(z.object({ nodeId: z.string(), serverId: z.string().optional() }))
.query(async ({ input, ctx }) => { .query(async ({ input, ctx }) => {
await assertServerInActiveOrg( if (input.serverId) {
input.serverId, const server = await findServerById(input.serverId);
ctx.session?.activeOrganizationId, if (server.organizationId !== ctx.session?.activeOrganizationId) {
); throw new TRPCError({
code: "UNAUTHORIZED",
message: "You are not authorized to access this server",
});
}
}
return await getNodeInfo(input.nodeId, input.serverId); return await getNodeInfo(input.nodeId, input.serverId);
}), }),
getNodeApps: withPermission("server", "read") getNodeApps: withPermission("server", "read")
@@ -58,10 +51,15 @@ export const swarmRouter = createTRPCRouter({
}), }),
) )
.query(async ({ input, ctx }) => { .query(async ({ input, ctx }) => {
await assertServerInActiveOrg( if (input.serverId) {
input.serverId, const server = await findServerById(input.serverId);
ctx.session?.activeOrganizationId, if (server.organizationId !== ctx.session?.activeOrganizationId) {
); throw new TRPCError({
code: "UNAUTHORIZED",
message: "You are not authorized to access this server",
});
}
}
return getNodeApplications(input.serverId); return getNodeApplications(input.serverId);
}), }),
getAppInfos: withPermission("server", "read") getAppInfos: withPermission("server", "read")
@@ -84,10 +82,15 @@ export const swarmRouter = createTRPCRouter({
}), }),
) )
.query(async ({ input, ctx }) => { .query(async ({ input, ctx }) => {
await assertServerInActiveOrg( if (input.serverId) {
input.serverId, const server = await findServerById(input.serverId);
ctx.session?.activeOrganizationId, if (server.organizationId !== ctx.session?.activeOrganizationId) {
); throw new TRPCError({
code: "UNAUTHORIZED",
message: "You are not authorized to access this server",
});
}
}
return await getApplicationInfo(input.appName, input.serverId); return await getApplicationInfo(input.appName, input.serverId);
}), }),
getContainerStats: withPermission("server", "read") getContainerStats: withPermission("server", "read")