gsadmin/DynamoDNS
1
0
Fork 0
mirror of https://github.com/freedbygrace/DynamoDNS.git synced 2026-07-26 11:38:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Refactor webhook authorization to use customer-based permissions.

Browse Source 
Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 9111ef36-26c8-4085-84ca-a35dc1fec1b5
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/7083d608-d6d3-4a6a-9a27-6286c5109627/576e7a1f-0f68-4e6c-8fa8-b07538fd6481.jpg
This commit is contained in:
alphaeusmote
2025-04-12 00:21:42 +00:00
parent a9b4b82709
commit e72cb0951d
1 changed files with 40 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/routes.ts
+40 -12
View File
@@ -1542,9 +1542,16 @@ export async function registerRoutes(app: Express): Promise<Server> {
return res.status(404).json({ message: "Webhook not found" });
}
// Check authorization
if (req.user?.role !== "admin" && webhook.organizationId !== req.user?.organizationId) {
return res.status(403).json({ message: "Not authorized to test this webhook" });
// Check authorization for non-admin users
if (req.user?.role !== "admin") {
// Get user's customers
const userCustomers = await storage.getUserCustomers(req.user?.id as string);
const userCustomerIds = userCustomers.map(c => c.id);
// Check if the user has access to the webhook's customer
if (!userCustomerIds.includes(webhook.customerId)) {
return res.status(403).json({ message: "Not authorized to test this webhook" });
}
}
const testPayload = {
@@ -1584,9 +1591,16 @@ export async function registerRoutes(app: Express): Promise<Server> {
return res.status(404).json({ message: "Webhook not found" });
}
// Permission check: admin can view all logs, others only for their organization's webhooks
if (req.user?.role !== "admin" && webhook.organizationId !== req.user?.organizationId) {
return res.status(403).json({ message: "Not authorized to access logs for this webhook" });
// Permission check: admin can view all logs, others only for their customer's webhooks
if (req.user?.role !== "admin") {
// Get user's customers
const userCustomers = await storage.getUserCustomers(req.user?.id as string);
const userCustomerIds = userCustomers.map(c => c.id);
// Check if the user has access to the webhook's customer
if (!userCustomerIds.includes(webhook.customerId)) {
return res.status(403).json({ message: "Not authorized to access logs for this webhook" });
}
}
try {
@@ -1620,9 +1634,16 @@ export async function registerRoutes(app: Express): Promise<Server> {
return res.status(404).json({ message: "Associated webhook not found" });
}
// Permission check
if (req.user?.role !== "admin" && webhook.organizationId !== req.user?.organizationId) {
return res.status(403).json({ message: "Not authorized to access this log" });
// Permission check for non-admin users
if (req.user?.role !== "admin") {
// Get user's customers
const userCustomers = await storage.getUserCustomers(req.user?.id as string);
const userCustomerIds = userCustomers.map(c => c.id);
// Check if the user has access to the webhook's customer
if (!userCustomerIds.includes(webhook.customerId)) {
return res.status(403).json({ message: "Not authorized to access this log" });
}
}
res.json(log);
@@ -1648,9 +1669,16 @@ export async function registerRoutes(app: Express): Promise<Server> {
return res.status(404).json({ message: "Associated webhook not found" });
}
// Permission check
if (req.user?.role !== "admin" && webhook.organizationId !== req.user?.organizationId) {
return res.status(403).json({ message: "Not authorized to retry this webhook" });
// Permission check for non-admin users
if (req.user?.role !== "admin") {
// Get user's customers
const userCustomers = await storage.getUserCustomers(req.user?.id as string);
const userCustomerIds = userCustomers.map(c => c.id);
// Check if the user has access to the webhook's customer
if (!userCustomerIds.includes(webhook.customerId)) {
return res.status(403).json({ message: "Not authorized to retry this webhook" });
}
}
// Only retry failed deliveries