Skip to content

fix: validate organization ownership for fetched proposals and proposal details #2389

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JivusAyrus merged 4 commits into from
Dec 4, 2025
Merged

fix: validate organization ownership for fetched proposals and proposal details #2389

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7e3ebee
fix: validate organization ownership for fetched proposals and propos…
JivusAyrus Dec 3, 2025
8b58f1c
fix: lint
JivusAyrus Dec 3, 2025
fe34111
refactor: update ProposalRepository to require organizationId for pro…
JivusAyrus Dec 4, 2025
c471fe7
Merge branch 'main' of github.com:wundergraph/cosmo into suvij/eng-86…
JivusAyrus Dec 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4,026 changes: 2,018 additions & 2,008 deletions connect-go/gen/proto/wg/cosmo/platform/v1/platform.pb.go
View file
Open in desktop

Large diffs are not rendered by default.

6 changes: 6 additions & 0 deletions connect/src/wg/cosmo/platform/v1/platform_pb.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21586,6 +21586,11 @@ export class GetProposedSchemaOfCheckedSubgraphRequest extends Message<GetPropos
*/
checkedSubgraphId = "";

/**
* @generated from field: string subgraphId = 3;
*/
subgraphId = "";

constructor(data?: PartialMessage<GetProposedSchemaOfCheckedSubgraphRequest>) {
super();
proto3.util.initPartial(data, this);
Expand All @@ -21596,6 +21601,7 @@ export class GetProposedSchemaOfCheckedSubgraphRequest extends Message<GetPropos
static readonly fields: FieldList = proto3.util.newFieldList(() => [
{ no: 1, name: "checkId", kind: "scalar", T: 9 /* ScalarType.STRING */ },
{ no: 2, name: "checkedSubgraphId", kind: "scalar", T: 9 /* ScalarType.STRING */ },
{ no: 3, name: "subgraphId", kind: "scalar", T: 9 /* ScalarType.STRING */ },
]);

static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetProposedSchemaOfCheckedSubgraphRequest {
Expand Down
2 changes: 1 addition & 1 deletion controlplane/src/core/bufservices/check/getCheckSummary.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ export function getCheckSummary(
const schemaLintRepo = new SchemaLintRepository(opts.db);
const schemaGraphPruningRepo = new SchemaGraphPruningRepository(opts.db);
const namespaceRepo = new NamespaceRepository(opts.db, authContext.organizationId);
const proposalRepo = new ProposalRepository(opts.db);
const proposalRepo = new ProposalRepository(opts.db, authContext.organizationId);

const namespace = await namespaceRepo.byName(req.namespace);
if (!namespace) {
Expand Down
15 changes: 15 additions & 0 deletions controlplane/src/core/bufservices/check/getProposedSchemaOfCheckedSubgraph.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ import {
import { SchemaCheckRepository } from '../../repositories/SchemaCheckRepository.js';
import type { RouterOptions } from '../../routes.js';
import { enrichLogger, getLogger, handleError } from '../../util.js';
import { SubgraphRepository } from '../../repositories/SubgraphRepository.js';

export function getProposedSchemaOfCheckedSubgraph(
opts: RouterOptions,
Expand All @@ -21,9 +22,23 @@ export function getProposedSchemaOfCheckedSubgraph(
logger = enrichLogger(ctx, logger, authContext);

const schemaCheckRepo = new SchemaCheckRepository(opts.db);
const subgraphRepo = new SubgraphRepository(logger, opts.db, authContext.organizationId);

const subgraph = await subgraphRepo.byId(req.subgraphId);
if (!subgraph) {
return {
response: {
code: EnumStatusCode.ERR_NOT_FOUND,
details: `Subgraph not found`,
},
proposedSchema: '',
};
}

const proposedSchema = await schemaCheckRepo.getProposedSchemaOfCheckedSubgraph({
checkId: req.checkId,
checkedSubgraphId: req.checkedSubgraphId,
subgraphId: req.subgraphId,
});

if (!proposedSchema || !proposedSchema.proposedSubgraphSchemaSDL) {
Expand Down
2 changes: 1 addition & 1 deletion controlplane/src/core/bufservices/proposal/configureNamespaceProposalConfig.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ export function configureNamespaceProposalConfig(
throw new UnauthorizedError();
}

const proposalRepo = new ProposalRepository(opts.db);
const proposalRepo = new ProposalRepository(opts.db, authContext.organizationId);
const namespaceRepo = new NamespaceRepository(opts.db, authContext.organizationId);
const auditLogRepo = new AuditLogRepository(opts.db);

Expand Down
2 changes: 1 addition & 1 deletion controlplane/src/core/bufservices/proposal/createProposal.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ export function createProposal(

const federatedGraphRepo = new FederatedGraphRepository(logger, opts.db, authContext.organizationId);
const subgraphRepo = new SubgraphRepository(logger, opts.db, authContext.organizationId);
const proposalRepo = new ProposalRepository(opts.db);
const proposalRepo = new ProposalRepository(opts.db, authContext.organizationId);
const auditLogRepo = new AuditLogRepository(opts.db);
const namespaceRepo = new NamespaceRepository(opts.db, authContext.organizationId);

Expand Down
2 changes: 1 addition & 1 deletion controlplane/src/core/bufservices/proposal/enableProposalsForNamespace.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ export function enableProposalsForNamespace(

const organizationRepo = new OrganizationRepository(logger, opts.db);
const namespaceRepo = new NamespaceRepository(opts.db, authContext.organizationId);
const proposalRepo = new ProposalRepository(opts.db);
const proposalRepo = new ProposalRepository(opts.db, authContext.organizationId);
const auditLogRepo = new AuditLogRepository(opts.db);

if (authContext.organizationDeactivated) {
Expand Down
2 changes: 1 addition & 1 deletion controlplane/src/core/bufservices/proposal/getNamespaceProposalConfig.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ export function getNamespaceProposalConfig(
logger = enrichLogger(ctx, logger, authContext);
const organizationRepo = new OrganizationRepository(logger, opts.db);
const namespaceRepo = new NamespaceRepository(opts.db, authContext.organizationId);
const proposalRepo = new ProposalRepository(opts.db);
const proposalRepo = new ProposalRepository(opts.db, authContext.organizationId);

const proposalsFeature = await organizationRepo.getFeature({
organizationId: authContext.organizationId,
Expand Down
6 changes: 3 additions & 3 deletions controlplane/src/core/bufservices/proposal/getProposal.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ export function getProposal(

const federatedGraphRepo = new FederatedGraphRepository(logger, opts.db, authContext.organizationId);
const subgraphRepo = new SubgraphRepository(logger, opts.db, authContext.organizationId);
const proposalRepo = new ProposalRepository(opts.db);
const proposalRepo = new ProposalRepository(opts.db, authContext.organizationId);

const proposal = await proposalRepo.ById(req.proposalId);
if (!proposal) {
Expand All @@ -43,13 +43,13 @@ export function getProposal(
return {
response: {
code: EnumStatusCode.ERR_NOT_FOUND,
details: `Federated graph ${proposal.proposal.federatedGraphId} not found`,
details: `Federated graph of the proposal not found`,
},
currentSubgraphs: [],
};
}

const latestCheck = await proposalRepo.getLatestCheckForProposal(proposal.proposal.id, authContext.organizationId);
const latestCheck = await proposalRepo.getLatestCheckForProposal(proposal.proposal.id);

const currentSubgraphs = [];
for (const subgraph of proposal.proposalSubgraphs) {
Expand Down
16 changes: 15 additions & 1 deletion controlplane/src/core/bufservices/proposal/getProposalChecks.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ import { OrganizationRepository } from '../../repositories/OrganizationRepositor
import { ProposalRepository } from '../../repositories/ProposalRepository.js';
import type { RouterOptions } from '../../routes.js';
import { enrichLogger, getLogger, handleError, validateDateRanges } from '../../util.js';
import { FederatedGraphRepository } from '../../repositories/FederatedGraphRepository.js';

export function getProposalChecks(
opts: RouterOptions,
Expand All @@ -21,8 +22,9 @@ export function getProposalChecks(
const authContext = await opts.authenticator.authenticate(ctx.requestHeader);
logger = enrichLogger(ctx, logger, authContext);

const proposalRepo = new ProposalRepository(opts.db);
const proposalRepo = new ProposalRepository(opts.db, authContext.organizationId);
const orgRepo = new OrganizationRepository(logger, opts.db, opts.billingDefaultPlanId);
const federatedGraphRepo = new FederatedGraphRepository(logger, opts.db, authContext.organizationId);

// Check if the proposal exists
const proposal = await proposalRepo.ById(req.proposalId);
Expand All @@ -37,6 +39,18 @@ export function getProposalChecks(
};
}

const federatedGraph = await federatedGraphRepo.byId(proposal.proposal.federatedGraphId);
if (!federatedGraph) {
return {
response: {
code: EnumStatusCode.ERR_NOT_FOUND,
details: `Federated graph of the proposal not found`,
},
checks: [],
totalChecksCount: 0,
};
}

const breakingChangeRetention = await orgRepo.getFeature({
organizationId: authContext.organizationId,
featureId: 'breaking-change-retention',
Expand Down
7 changes: 2 additions & 5 deletions controlplane/src/core/bufservices/proposal/getProposalsByFederatedGraph.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ export function getProposalsByFederatedGraph(
logger = enrichLogger(ctx, logger, authContext);

const federatedGraphRepo = new FederatedGraphRepository(logger, opts.db, authContext.organizationId);
const proposalRepo = new ProposalRepository(opts.db);
const proposalRepo = new ProposalRepository(opts.db, authContext.organizationId);
const orgRepo = new OrganizationRepository(logger, opts.db, opts.billingDefaultPlanId);
const namespaceRepo = new NamespaceRepository(opts.db, authContext.organizationId);

Expand Down Expand Up @@ -118,10 +118,7 @@ export function getProposalsByFederatedGraph(
// Get the latest check success for each proposal
const proposalsWithChecks = await Promise.all(
proposals.map(async (proposal) => {
const latestCheck = await proposalRepo.getLatestCheckForProposal(
proposal.proposal.id,
authContext.organizationId,
);
const latestCheck = await proposalRepo.getLatestCheckForProposal(proposal.proposal.id);
return {
...proposal,
latestCheckSuccess: latestCheck?.isSuccessful || false,
Expand Down
2 changes: 1 addition & 1 deletion controlplane/src/core/bufservices/proposal/updateProposal.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ export function updateProposal(
const authContext = await opts.authenticator.authenticate(ctx.requestHeader);
logger = enrichLogger(ctx, logger, authContext);

const proposalRepo = new ProposalRepository(opts.db);
const proposalRepo = new ProposalRepository(opts.db, authContext.organizationId);
const federatedGraphRepo = new FederatedGraphRepository(logger, opts.db, authContext.organizationId);
const subgraphRepo = new SubgraphRepository(logger, opts.db, authContext.organizationId);
const auditLogRepo = new AuditLogRepository(opts.db);
Expand Down
2 changes: 1 addition & 1 deletion controlplane/src/core/bufservices/subgraph/deleteFederatedSubgraph.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ export function deleteFederatedSubgraph(
logger = enrichLogger(ctx, logger, authContext);

const subgraphRepo = new SubgraphRepository(logger, opts.db, authContext.organizationId);
const proposalRepo = new ProposalRepository(opts.db);
const proposalRepo = new ProposalRepository(opts.db, authContext.organizationId);
const namespaceRepo = new NamespaceRepository(opts.db, authContext.organizationId);
const fedGraphRepo = new FederatedGraphRepository(logger, opts.db, authContext.organizationId);
const orgWebhooks = new OrganizationWebhookService(
Expand Down
2 changes: 1 addition & 1 deletion controlplane/src/core/bufservices/subgraph/publishFederatedSubgraph.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ export function publishFederatedSubgraph(
const namespaceRepo = new NamespaceRepository(opts.db, authContext.organizationId);
const subgraphRepo = new SubgraphRepository(logger, opts.db, authContext.organizationId);
const schemaGraphPruningRepo = new SchemaGraphPruningRepository(opts.db);
const proposalRepo = new ProposalRepository(opts.db);
const proposalRepo = new ProposalRepository(opts.db, authContext.organizationId);
const pluginRepo = new PluginRepository(opts.db, authContext.organizationId);
const orgRepo = new OrganizationRepository(logger, opts.db, opts.billingDefaultPlanId);

Expand Down
Loading
Loading