shiyue/kan
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: prevent cross-workspace access on member and permission endpoints

Browse Source
This commit is contained in:
Henry
2026-02-23 16:53:43 +00:00
parent d42540b9ef
commit 317e7cab3c
2 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
packages/api/src/routers/member.ts
View File

@@ -210,11 +210,12 @@ export const memberRouter = createTRPCRouter({
input.memberPublicId,
);
if (!member)
if (!member || member.workspaceId !== workspace.id) {
throw new TRPCError({
message: `Member with public ID ${input.memberPublicId} not found`,
code: "NOT_FOUND",
});
}
const deletedMember = await memberRepo.softDelete(ctx.db, {
memberId: member.id,
@@ -720,7 +721,7 @@ export const memberRouter = createTRPCRouter({
input.memberPublicId,
);
if (!member) {
if (!member || member.workspaceId !== workspace.id) {
throw new TRPCError({
message: "Member not found",
code: "NOT_FOUND",

8
packages/api/src/routers/permission.ts
View File

@@ -133,7 +133,7 @@ export const permissionRouter = createTRPCRouter({
input.memberPublicId,
);
if (!member) {
if (!member || member.workspaceId !== workspace.id) {
throw new TRPCError({
message: "Member not found",
code: "NOT_FOUND",
@@ -209,7 +209,7 @@ export const permissionRouter = createTRPCRouter({
input.memberPublicId,
);
if (!member) {
if (!member || member.workspaceId !== workspace.id) {
throw new TRPCError({
message: "Member not found",
code: "NOT_FOUND",
@@ -274,7 +274,7 @@ export const permissionRouter = createTRPCRouter({
input.memberPublicId,
);
if (!member) {
if (!member || member.workspaceId !== workspace.id) {
throw new TRPCError({
message: "Member not found",
code: "NOT_FOUND",
@@ -339,7 +339,7 @@ export const permissionRouter = createTRPCRouter({
input.memberPublicId,
);
if (!member) {
if (!member || member.workspaceId !== workspace.id) {
throw new TRPCError({
message: "Member not found",
code: "NOT_FOUND",