fix: prevent cross-workspace access on member and permission endpoints

packages/api/src/routers/member.ts

@@ -210,11 +210,12 @@ export const memberRouter = createTRPCRouter({
         input.memberPublicId,
       );
 
-      if (!member)
+      if (!member || member.workspaceId !== workspace.id) {
         throw new TRPCError({
           message: `Member with public ID ${input.memberPublicId} not found`,
           code: "NOT_FOUND",
         });
+      }
 
       const deletedMember = await memberRepo.softDelete(ctx.db, {
         memberId: member.id,
@@ -720,7 +721,7 @@ export const memberRouter = createTRPCRouter({
         input.memberPublicId,
       );
 
-      if (!member) {
+      if (!member || member.workspaceId !== workspace.id) {
         throw new TRPCError({
           message: "Member not found",
           code: "NOT_FOUND",

packages/api/src/routers/permission.ts

@@ -133,7 +133,7 @@ export const permissionRouter = createTRPCRouter({
         input.memberPublicId,
       );
 
-      if (!member) {
+      if (!member || member.workspaceId !== workspace.id) {
         throw new TRPCError({
           message: "Member not found",
           code: "NOT_FOUND",
@@ -209,7 +209,7 @@ export const permissionRouter = createTRPCRouter({
         input.memberPublicId,
       );
 
-      if (!member) {
+      if (!member || member.workspaceId !== workspace.id) {
         throw new TRPCError({
           message: "Member not found",
           code: "NOT_FOUND",
@@ -274,7 +274,7 @@ export const permissionRouter = createTRPCRouter({
         input.memberPublicId,
       );
 
-      if (!member) {
+      if (!member || member.workspaceId !== workspace.id) {
         throw new TRPCError({
           message: "Member not found",
           code: "NOT_FOUND",
@@ -339,7 +339,7 @@ export const permissionRouter = createTRPCRouter({
         input.memberPublicId,
       );
 
-      if (!member) {
+      if (!member || member.workspaceId !== workspace.id) {
         throw new TRPCError({
           message: "Member not found",
           code: "NOT_FOUND",