From b40d8ed505db36dd0a8e0995ea665391e4645f73 Mon Sep 17 00:00:00 2001
From: Mauricio Siu <siumauricio@icloud.com>
Date: Thu, 24 Sep 2026 01:25:21 -0600
Subject: [PATCH] feat(log-management): add organization validation for log
 providers and servers

---
 .../server/api/routers/log-provider.ts        | 41 +------------------
 .../src/services/log-management/service.ts    | 39 ++++++++++++++++++
 2 files changed, 41 insertions(+), 39 deletions(-)

diff --git a/apps/dokploy/server/api/routers/log-provider.ts b/apps/dokploy/server/api/routers/log-provider.ts
index 9a2ce8204..0522003b9 100644
--- a/apps/dokploy/server/api/routers/log-provider.ts
+++ b/apps/dokploy/server/api/routers/log-provider.ts
@@ -1,9 +1,10 @@
 import {
+	assertLogProvidersBelongToOrg,
+	assertServerBelongsToOrg,
 	claimWebServerLogManagement,
 	createLogProvider,
 	findLogProviderById,
 	findLogProvidersByOrganization,
-	findServerById,
 	getLogManagementServerStatus,
 	logProviderAdapters,
 	removeLogProvider,
@@ -26,44 +27,6 @@ import {
 } from "@/server/db/schema";
 import { createTRPCRouter, protectedProcedure, withPermission } from "../trpc";
 
-const assertServerBelongsToOrg = async (
-	serverId: string | undefined,
-	organizationId: string,
-) => {
-	if (!serverId) return;
-	const server = await findServerById(serverId);
-	if (server.organizationId !== organizationId) {
-		throw new TRPCError({
-			code: "UNAUTHORIZED",
-			message: "You are not authorized to access this server",
-		});
-	}
-};
-
-const assertLogProvidersBelongToOrg = async (
-	logProviderIds: string[],
-	organizationId: string,
-) => {
-	const providers = await findLogProvidersByOrganization(organizationId);
-	const byId = new Map(providers.map((p) => [p.logProviderId, p]));
-	for (const id of logProviderIds) {
-		if (!byId.has(id)) {
-			throw new TRPCError({
-				code: "UNAUTHORIZED",
-				message:
-					"One of the selected log providers is not in this organization",
-			});
-		}
-	}
-	if (!logProviderIds.some((id) => byId.get(id)?.enabled)) {
-		throw new TRPCError({
-			code: "BAD_REQUEST",
-			message:
-				"Select at least one enabled log provider — a disabled one ships nothing.",
-		});
-	}
-};
-
 export const logProviderRouter = createTRPCRouter({
 	create: withPermission("logProvider", "create")
 		.input(apiCreateLogProvider)
diff --git a/packages/server/src/services/log-management/service.ts b/packages/server/src/services/log-management/service.ts
index 31467185f..5a6c2606c 100644
--- a/packages/server/src/services/log-management/service.ts
+++ b/packages/server/src/services/log-management/service.ts
@@ -3,6 +3,7 @@ import {
 	type apiCreateLogProvider,
 	logProvider,
 } from "@dokploy/server/db/schema";
+import { findServerById } from "@dokploy/server/services/server";
 import { TRPCError } from "@trpc/server";
 import { and, eq } from "drizzle-orm";
 import type { z } from "zod";
@@ -267,3 +268,41 @@ export const sanitizeLogProvider = <
 	const { endpoint, apiKey, apiSecret, ...rest } = provider;
 	return rest;
 };
+
+export const assertServerBelongsToOrg = async (
+	serverId: string | undefined,
+	organizationId: string,
+) => {
+	if (!serverId) return;
+	const server = await findServerById(serverId);
+	if (server.organizationId !== organizationId) {
+		throw new TRPCError({
+			code: "UNAUTHORIZED",
+			message: "You are not authorized to access this server",
+		});
+	}
+};
+
+export const assertLogProvidersBelongToOrg = async (
+	logProviderIds: string[],
+	organizationId: string,
+) => {
+	const providers = await findLogProvidersByOrganization(organizationId);
+	const byId = new Map(providers.map((p) => [p.logProviderId, p]));
+	for (const id of logProviderIds) {
+		if (!byId.has(id)) {
+			throw new TRPCError({
+				code: "UNAUTHORIZED",
+				message:
+					"One of the selected log providers is not in this organization",
+			});
+		}
+	}
+	if (!logProviderIds.some((id) => byId.get(id)?.enabled)) {
+		throw new TRPCError({
+			code: "BAD_REQUEST",
+			message:
+				"Select at least one enabled log provider — a disabled one ships nothing.",
+		});
+	}
+};