fix(security): enforce project ownership on project + project-email routes (stable) (#966)
* fix(security): enforce project ownership (GHSA-wrg5, GHSA-93x4) Project routes authorized on generic events.view / events.edit with NO ownership check, so an editor-like admin could enumerate, read, update and aggregate projects belonging to other admins' events. The project email endpoints keyed on an email_queue id alone — any admin with events.view / email.send could preview, resend, cancel or retry ANY queued mail by walking ids. The earlier 'needs a migration, deferred' assessment was wrong in one direction and right in another: ownership IS derivable transitively via events.project_id -> events.created_by, but only for projects that already have a linked event. A brand-new EMPTY project has no derivable owner, which is exactly where the create -> attach flow starts. So migration 167 adds projects.created_by (backfilled from the single linked event owner, skipping ambiguous multi-owner projects) and createProject finally persists the adminId it was already being passed. - ownedProjectIds(): union of the stored owner and the transitive path, so pre-167 rows and new empty projects both resolve. Reads created_by defensively so an instance that hasn't run 167 falls back to the transitive rule instead of throwing. - requireProjectOwnership on detail/update/attach-event/attach-quote/ attach-contract/overview; list filtered by an id allowlist (empty array means 'owns nothing' and must return no rows, hence null-vs-[] care). - POST /:id/events also validates the INCOMING eventId — owning the project is not enough, or an editor could pull a foreign event in and read its rolled-up documents via /:id/overview. - Queued-email routes scoped via email_queue.event_id. CRM document mail has event_id NULL and no ownable parent here, so a scoped caller is denied rather than guessed into access. 404 (not 403) so it isn't an id oracle. Note: adminEmail.js:315/332 let any email.view/edit admin archive or delete any email_queue row — the same class, pre-existing and outside these two advisories. Left untouched and reported rather than silently widened. * fix(security): codex round 2 — make the stored project owner authoritative (GHSA-wrg5) The first predicate union'd 'any linked event I can see' with the stored owner, which opened two holes: - A project owned by admin B containing ONE legacy ownerless event became readable by every admin — and /:id/overview aggregates B's other events, invoices and emails, so a single legacy event exposed the whole project. - Migration 167 deliberately leaves multi-owner (ambiguous) projects NULL rather than guessing an owner. A NULL owner was then treated as 'everyone's', so exactly those mixed projects became globally accessible. Now: the stored created_by wins outright, and a project without a usable stored owner only derives access when EVERY linked event is accessible (and at least one exists). A created_by pointing at a hard-deleted admin degrades to 'no usable owner' so the project falls back to its events instead of being locked away — no ON DELETE SET NULL migration needed. A project with neither a usable owner nor linked events stays super_admin-only: failing closed beats failing open, and a super_admin can reassign it. Also returns a knex SUBQUERY rather than a materialised id list, so a large project count can't hit the driver's bind-parameter limit. * fix(security): codex round 3 — enforce deal-lineage ownership on project attach (GHSA-wrg5) requireProjectOwnership vets only the DESTINATION project, while attaching a quote or contract cascades through linkDealToProject — which re-points every event the deal produced into that project. An editor could therefore create an empty project of their own, attach another admin's quote, and pull that admin's events (plus the invoices, emails and gallery that roll up with them) into a project they own and can read via /:id/overview. The single-customer guard did not stand in the way: an unassigned project ADOPTS the deal's customer rather than rejecting it. linkDealToProject now refuses to move lineage events the actor cannot own, and assignDocument cascades BEFORE stamping the document so a refused attach leaves nothing half-applied (the old order committed the foreign document into the caller's project and only then declined the cascade). The quote/contract create+update paths, which reach the same cascade with an arbitrary project_id, thread their adminId through as well; isSuperAdmin() resolves the role for them and fails closed when it cannot. Events are the only ownership signal a deal carries — quotes and contracts have no created_by in this schema — so a lineage that produced no event still cannot be attributed. That is a property of the CRM model, noted in the code. Claude-Session: https://claude.ai/code/session_01F211U4dDbEj4zXiyKbi9me (cherry picked from commit 688e318850db1b5f4ea2a4ae3c0fcf0fc137620d) * docs(security): drop the stale ownership JSDoc left by the rebase (GHSA-wrg5) Rebasing onto stable (which had gained scopeEventsQuery from #963) replayed the round-1 doc block above round-2's replacement, leaving a comment that describes the ORIGINAL union rule — "a project is the caller's when … it has at least one linked event they own" — directly above the code that deliberately no longer does that. That union is the hole round 2 closed; a comment asserting it is worse than none. Claude-Session: https://claude.ai/code/session_01F211U4dDbEj4zXiyKbi9me --------- Co-authored-by: Paul Nothaft <[email protected]>
This commit is contained in:
Paul Nothaft
co-authored by
Paul Nothaft
Paul Nothaft
parent
7f27e6771f
commit
fecc18cbc8
@@ -15,6 +15,7 @@ const { requirePermission, userHasAnyPermission } = require('../middleware/permi
|
||||
const { handleAsync, validateRequest, successResponse } = require('../utils/routeHelpers');
|
||||
const projectService = require('../services/projectService');
|
||||
const { db } = require('../database/db');
|
||||
const { ownedProjectsSubquery, requireProjectOwnership, filterOwnedEventIds } = require('../middleware/ownership');
|
||||
const { ForbiddenError } = require('../utils/errors');
|
||||
|
||||
const router = express.Router();
|
||||
@@ -65,10 +66,15 @@ router.get('/', requirePermission('events.view'), handleAsync(async (req, res) =
|
||||
bills: await userHasAnyPermission(req.admin.id, ['bills.view']),
|
||||
quotes: await userHasAnyPermission(req.admin.id, ['quotes.view']),
|
||||
};
|
||||
// Only the caller's projects (GHSA-wrg5). Passed as a SUBQUERY so a large
|
||||
// project count can't hit the driver's bind-parameter limit; null means
|
||||
// unrestricted.
|
||||
const projectIds = ownedProjectsSubquery(req.admin);
|
||||
const projects = await projectService.listProjects({
|
||||
search: req.query.q || '',
|
||||
status: req.query.status || null,
|
||||
perms,
|
||||
projectIds,
|
||||
});
|
||||
return successResponse(res, { projects });
|
||||
}));
|
||||
@@ -88,7 +94,7 @@ router.post('/',
|
||||
);
|
||||
|
||||
// Detail
|
||||
router.get('/:id', requirePermission('events.view'), [param('id').isInt({ min: 1 })], handleAsync(async (req, res) => {
|
||||
router.get('/:id', requirePermission('events.view'), requireProjectOwnership, [param('id').isInt({ min: 1 })], handleAsync(async (req, res) => {
|
||||
validateRequest(req);
|
||||
const project = await projectService.getProjectById(parseInt(req.params.id, 10));
|
||||
if (!project) return res.status(404).json({ error: 'Project not found' });
|
||||
@@ -98,6 +104,7 @@ router.get('/:id', requirePermission('events.view'), [param('id').isInt({ min: 1
|
||||
// Update
|
||||
router.put('/:id',
|
||||
requirePermission('events.edit'),
|
||||
requireProjectOwnership,
|
||||
[
|
||||
param('id').isInt({ min: 1 }),
|
||||
body('name').optional().isString().trim().isLength({ min: 1, max: 255 }),
|
||||
@@ -119,10 +126,20 @@ router.put('/:id',
|
||||
// Attach an event to the project
|
||||
router.post('/:id/events',
|
||||
requirePermission('events.edit'),
|
||||
requireProjectOwnership,
|
||||
[param('id').isInt({ min: 1 }), body('eventId').isInt({ min: 1 })],
|
||||
handleAsync(async (req, res) => {
|
||||
validateRequest(req);
|
||||
const result = await projectService.assignEvent(parseInt(req.params.id, 10), parseInt(req.body.eventId, 10));
|
||||
const eventId = parseInt(req.body.eventId, 10);
|
||||
// Both sides must be the caller's (GHSA-wrg5): requireProjectOwnership
|
||||
// covers the project, this covers the INCOMING event. Otherwise an editor
|
||||
// could pull a foreign event into a project they own and then read that
|
||||
// event's rolled-up documents through /:id/overview.
|
||||
const { denied } = await filterOwnedEventIds(req.admin, [eventId]);
|
||||
if (denied.length) {
|
||||
return res.status(403).json({ error: 'That event is not yours to attach' });
|
||||
}
|
||||
const result = await projectService.assignEvent(parseInt(req.params.id, 10), eventId);
|
||||
return successResponse(res, result, 200, 'Event attached to project');
|
||||
}),
|
||||
);
|
||||
@@ -132,12 +149,13 @@ router.post('/:id/events',
|
||||
// mutates a separately-permissioned document domain (GHSA-v4vw).
|
||||
router.post('/:id/quotes',
|
||||
requirePermission(['events.edit', 'quotes.manage'], { requireAll: true }),
|
||||
requireProjectOwnership,
|
||||
[param('id').isInt({ min: 1 }), body('quoteId').isInt({ min: 1 })],
|
||||
handleAsync(async (req, res) => {
|
||||
validateRequest(req);
|
||||
const quoteId = parseInt(req.body.quoteId, 10);
|
||||
await assertCascadePermitted(req, 'quotes', quoteId, 'contracts', 'contracts.manage');
|
||||
const result = await projectService.assignQuote(parseInt(req.params.id, 10), quoteId);
|
||||
const result = await projectService.assignQuote(parseInt(req.params.id, 10), quoteId, req.admin);
|
||||
return successResponse(res, result, 200, 'Quote attached to project');
|
||||
}),
|
||||
);
|
||||
@@ -146,18 +164,19 @@ router.post('/:id/quotes',
|
||||
// to events.edit (GHSA-v4vw).
|
||||
router.post('/:id/contracts',
|
||||
requirePermission(['events.edit', 'contracts.manage'], { requireAll: true }),
|
||||
requireProjectOwnership,
|
||||
[param('id').isInt({ min: 1 }), body('contractId').isInt({ min: 1 })],
|
||||
handleAsync(async (req, res) => {
|
||||
validateRequest(req);
|
||||
const contractId = parseInt(req.body.contractId, 10);
|
||||
await assertCascadePermitted(req, 'contracts', contractId, 'quotes', 'quotes.manage');
|
||||
const result = await projectService.assignContract(parseInt(req.params.id, 10), contractId);
|
||||
const result = await projectService.assignContract(parseInt(req.params.id, 10), contractId, req.admin);
|
||||
return successResponse(res, result, 200, 'Contract attached to project');
|
||||
}),
|
||||
);
|
||||
|
||||
// The cockpit aggregation — doc types gated on the admin's own permissions
|
||||
router.get('/:id/overview', requirePermission('events.view'), [param('id').isInt({ min: 1 })], handleAsync(async (req, res) => {
|
||||
router.get('/:id/overview', requirePermission('events.view'), requireProjectOwnership, [param('id').isInt({ min: 1 })], handleAsync(async (req, res) => {
|
||||
validateRequest(req);
|
||||
const perms = {
|
||||
bills: await userHasAnyPermission(req.admin.id, ['bills.view']),
|
||||
@@ -168,8 +187,37 @@ router.get('/:id/overview', requirePermission('events.view'), [param('id').isInt
|
||||
return successResponse(res, overview);
|
||||
}));
|
||||
|
||||
/**
|
||||
* These routes key on an `email_queue` id alone (GHSA-93x4) — nothing tied the
|
||||
* row to a project or event the caller can see, so any admin holding
|
||||
* `events.view` / `email.send` could preview, resend, cancel or retry ANY
|
||||
* queued mail on the instance by walking ids.
|
||||
*
|
||||
* Scoped via `email_queue.event_id` → the caller's owned events. `event_id` is
|
||||
* NULL for CRM document mail (quote/contract/invoice sends carry no event), and
|
||||
* those rows have no ownable parent here, so a scoped caller is denied them
|
||||
* rather than guessed into access. 404, not 403, so this isn't an id oracle.
|
||||
*/
|
||||
async function requireOwnedQueuedEmail(req, res, next) {
|
||||
try {
|
||||
if (req.admin?.roleName === 'super_admin') return next();
|
||||
const emailId = parseInt(req.params.emailId, 10);
|
||||
const row = await db('email_queue').where({ id: emailId }).first('event_id');
|
||||
if (!row || !row.event_id) {
|
||||
return res.status(404).json({ error: 'Email not found' });
|
||||
}
|
||||
const { denied } = await filterOwnedEventIds(req.admin, [row.event_id]);
|
||||
if (denied.length) {
|
||||
return res.status(404).json({ error: 'Email not found' });
|
||||
}
|
||||
return next();
|
||||
} catch (err) {
|
||||
return next(err);
|
||||
}
|
||||
}
|
||||
|
||||
// Email preview — the ACTUAL sent HTML (or null for pre-rendered_html rows)
|
||||
router.get('/email/:emailId/preview', requirePermission('events.view'), [param('emailId').isInt({ min: 1 })], handleAsync(async (req, res) => {
|
||||
router.get('/email/:emailId/preview', requirePermission('events.view'), [param('emailId').isInt({ min: 1 })], requireOwnedQueuedEmail, handleAsync(async (req, res) => {
|
||||
validateRequest(req);
|
||||
const preview = await projectService.getEmailPreview(parseInt(req.params.emailId, 10));
|
||||
return successResponse(res, preview);
|
||||
@@ -182,9 +230,9 @@ const emailAction = (fn) => handleAsync(async (req, res) => {
|
||||
const result = await projectService[fn](parseInt(req.params.emailId, 10), req.admin.id);
|
||||
return successResponse(res, result);
|
||||
});
|
||||
router.post('/email/:emailId/resend', requirePermission('email.send'), [param('emailId').isInt({ min: 1 })], emailAction('resendEmail'));
|
||||
router.post('/email/:emailId/cancel', requirePermission('email.send'), [param('emailId').isInt({ min: 1 })], emailAction('cancelEmail'));
|
||||
router.post('/email/:emailId/retry', requirePermission('email.send'), [param('emailId').isInt({ min: 1 })], emailAction('retryEmail'));
|
||||
router.post('/email/:emailId/send-now', requirePermission('email.send'), [param('emailId').isInt({ min: 1 })], emailAction('sendEmailNow'));
|
||||
router.post('/email/:emailId/resend', requirePermission('email.send'), [param('emailId').isInt({ min: 1 })], requireOwnedQueuedEmail, emailAction('resendEmail'));
|
||||
router.post('/email/:emailId/cancel', requirePermission('email.send'), [param('emailId').isInt({ min: 1 })], requireOwnedQueuedEmail, emailAction('cancelEmail'));
|
||||
router.post('/email/:emailId/retry', requirePermission('email.send'), [param('emailId').isInt({ min: 1 })], requireOwnedQueuedEmail, emailAction('retryEmail'));
|
||||
router.post('/email/:emailId/send-now', requirePermission('email.send'), [param('emailId').isInt({ min: 1 })], requireOwnedQueuedEmail, emailAction('sendEmailNow'));
|
||||
|
||||
module.exports = router;
|
||||
|
||||
Reference in New Issue
Block a user