fix: validate organization ownership for fetched proposals and proposal details

connect/src/wg/cosmo/platform/v1/platform_pb.ts

@@ -21586,6 +21586,11 @@ export class GetProposedSchemaOfCheckedSubgraphRequest extends Message<GetPropos
    */
   checkedSubgraphId = "";
 
+  /**
+   * @generated from field: string subgraphId = 3;
+   */
+  subgraphId = "";
+
   constructor(data?: PartialMessage<GetProposedSchemaOfCheckedSubgraphRequest>) {
     super();
     proto3.util.initPartial(data, this);
@@ -21596,6 +21601,7 @@ export class GetProposedSchemaOfCheckedSubgraphRequest extends Message<GetPropos
   static readonly fields: FieldList = proto3.util.newFieldList(() => [
     { no: 1, name: "checkId", kind: "scalar", T: 9 /* ScalarType.STRING */ },
     { no: 2, name: "checkedSubgraphId", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 3, name: "subgraphId", kind: "scalar", T: 9 /* ScalarType.STRING */ },
   ]);
 
   static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetProposedSchemaOfCheckedSubgraphRequest {

controlplane/src/core/bufservices/check/getProposedSchemaOfCheckedSubgraph.ts

@@ -8,6 +8,7 @@ import {
 import { SchemaCheckRepository } from '../../repositories/SchemaCheckRepository.js';
 import type { RouterOptions } from '../../routes.js';
 import { enrichLogger, getLogger, handleError } from '../../util.js';
+import { SubgraphRepository } from '../../repositories/SubgraphRepository.js';
 
 export function getProposedSchemaOfCheckedSubgraph(
   opts: RouterOptions,
@@ -21,9 +22,23 @@ export function getProposedSchemaOfCheckedSubgraph(
     logger = enrichLogger(ctx, logger, authContext);
 
     const schemaCheckRepo = new SchemaCheckRepository(opts.db);
+    const subgraphRepo = new SubgraphRepository(logger, opts.db, authContext.organizationId);
+
+    const subgraph = await subgraphRepo.byId(req.subgraphId);
+    if (!subgraph) {
+      return {
+        response: {
+          code: EnumStatusCode.ERR_NOT_FOUND,
+          details: `Subgraph not found`,
+        },
+        proposedSchema: '',
+      };
+    }
+
     const proposedSchema = await schemaCheckRepo.getProposedSchemaOfCheckedSubgraph({
       checkId: req.checkId,
       checkedSubgraphId: req.checkedSubgraphId,
+      subgraphId: req.subgraphId,
     });
 
     if (!proposedSchema || !proposedSchema.proposedSubgraphSchemaSDL) {

controlplane/src/core/bufservices/proposal/getProposal.ts

@@ -43,7 +43,7 @@ export function getProposal(
       return {
         response: {
           code: EnumStatusCode.ERR_NOT_FOUND,
-          details: `Federated graph ${proposal.proposal.federatedGraphId} not found`,
+          details: `Federated graph of the proposal not found`,
         },
         currentSubgraphs: [],
       };

controlplane/src/core/bufservices/proposal/getProposalChecks.ts

@@ -9,6 +9,7 @@ import { OrganizationRepository } from '../../repositories/OrganizationRepositor
 import { ProposalRepository } from '../../repositories/ProposalRepository.js';
 import type { RouterOptions } from '../../routes.js';
 import { enrichLogger, getLogger, handleError, validateDateRanges } from '../../util.js';
+import { FederatedGraphRepository } from '../../repositories/FederatedGraphRepository.js';
 
 export function getProposalChecks(
   opts: RouterOptions,
@@ -23,6 +24,7 @@ export function getProposalChecks(
 
     const proposalRepo = new ProposalRepository(opts.db);
     const orgRepo = new OrganizationRepository(logger, opts.db, opts.billingDefaultPlanId);
+    const federatedGraphRepo = new FederatedGraphRepository(logger, opts.db, authContext.organizationId);
 
     // Check if the proposal exists
     const proposal = await proposalRepo.ById(req.proposalId);
@@ -37,6 +39,18 @@ export function getProposalChecks(
       };
     }
 
+    const federatedGraph = await federatedGraphRepo.byId(proposal.proposal.federatedGraphId);
+    if (!federatedGraph) {
+      return {
+        response: {
+          code: EnumStatusCode.ERR_NOT_FOUND,
+          details: `Federated graph of the proposal not found`,
+        },
+        checks: [],
+        totalChecksCount: 0,
+      };
+    }
+
     const breakingChangeRetention = await orgRepo.getFeature({
       organizationId: authContext.organizationId,
       featureId: 'breaking-change-retention',

controlplane/src/core/repositories/SchemaCheckRepository.ts

@@ -571,14 +571,17 @@ export class SchemaCheckRepository {
   public getProposedSchemaOfCheckedSubgraph({
     checkId,
     checkedSubgraphId,
+    subgraphId,
   }: {
     checkId: string;
     checkedSubgraphId: string;
+    subgraphId: string;
   }) {
     return this.db.query.schemaCheckSubgraphs.findFirst({
       where: and(
         eq(schema.schemaCheckSubgraphs.schemaCheckId, checkId),
         eq(schema.schemaCheckSubgraphs.id, checkedSubgraphId),
+        eq(schema.schemaCheckSubgraphs.subgraphId, subgraphId),
       ),
       columns: {
         proposedSubgraphSchemaSDL: true,

proto/wg/cosmo/platform/v1/platform.proto

@@ -2736,6 +2736,7 @@ message SetGraphRouterCompatibilityVersionResponse {
 message GetProposedSchemaOfCheckedSubgraphRequest {
   string checkId = 1;
   string checkedSubgraphId = 2;
+  string subgraphId = 3;
 }
 
 message GetProposedSchemaOfCheckedSubgraphResponse {

studio/src/pages/[organizationSlug]/[namespace]/graph/[slug]/checks/[checkId]/index.tsx

@@ -168,6 +168,7 @@ const ProposedSchemas = ({
     {
       checkId,
       checkedSubgraphId: activeSubgraph?.id,
+      subgraphId: activeSubgraph?.subgraphId,
     },
     {
       enabled: !!activeSubgraph && !!activeSubgraphName,