Hotfix: Template swap security

[chrismaddalena]

CHANGELOG

[7.1.2] - 24 June 2026

Security

• Fixed additional client-scoped report template authorization bypasses in template swapping, report generation, archive generation, linting, and lint result endpoints
  • Report template selection now only accepts global templates or templates scoped to the report project's client
  • This fix includes two temporary breaking changes for the API while we work on a custom endpoint to handle this new business logic:
    • Breaking: The GraphQL API no longer allows user or manager roles to set report template ID columns directly when creating or updating reports
    • Breaking: The GraphQL API no longer allows user or manager roles to update a report's project ID column directly

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 81df99c450

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[augmentcode]

🤖 Augment PR Summary

Summary: This PR closes multiple authorization bypasses related to swapping and using client-scoped report templates.

Changes:

• Restricts report template selection to either global templates or templates scoped to the report project’s client.
• Removes GraphQL write permissions for docx_template_id/pptx_template_id for user and manager roles (breaking change).
• Adds helper methods on ReportTemplate to validate applicability to a project/report and combines that with user visibility checks.
• Updates report creation/update and template-swap forms to scope template querysets by the selected project/client.
• Hardens the template swap, report generation, archive generation, and template linting/lint-results endpoints with additional checks.
• Adds targeted tests for Hasura metadata permissions and for view/form behaviors around client-scoped templates.

Technical Notes: The implementation relies on ReportTemplate.user_can_view + client matching (can_apply_to_report) to prevent applying templates across clients, and uses 403 responses for unauthorized lint/lint-results access.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.

[Copilot]

Pull request overview

This PR is a security hotfix to close authorization bypass paths around client-scoped report templates across the Django UI flows and the Hasura GraphQL API, ensuring templates can only be applied when they’re global or scoped to the report’s project client.

Changes:

• Removed GraphQL write access to docx_template_id/pptx_template_id for user and manager roles in Hasura metadata (breaking API change).
• Added server-side enforcement that templates can only be applied to reports/projects where they are in-scope (swap endpoints, generation endpoints, archive generation).
• Updated report forms and added test coverage to validate the new authorization rules.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
hasura-docker/metadata/databases/default/tables/public_reporting_report.yaml	Removes template ID columns from GraphQL insert/update permissions for user/manager.
ghostwriter/reporting/models.py	Adds helper methods to determine whether a template can be applied to a given project/report and by a given user.
ghostwriter/reporting/forms.py	Restricts template dropdown querysets to global + selected project’s client-scoped templates.
ghostwriter/reporting/views.py	Enforces user_can_apply_to_report during template swap and locks down template lint endpoints with RBAC checks.
ghostwriter/reporting/views2/report.py	Blocks report generation when selected templates are not applicable to the report’s client scope.
ghostwriter/reporting/archive.py	Prevents archiving when report templates are not applicable to the report’s client scope.
ghostwriter/reporting/tests/test_views.py	Adds view tests for template lint access and for template swap/generation client-scoping enforcement.
ghostwriter/reporting/tests/test_models.py	Adds coverage for archive rejection when a foreign client-scoped template is assigned.
ghostwriter/reporting/tests/test_forms.py	Adds coverage ensuring forms only allow templates scoped to the report/project client.
ghostwriter/commandcenter/forms.py	Adds validation preventing client-scoped templates from being set as global defaults.
ghostwriter/commandcenter/tests/test_forms.py	Adds test cases ensuring client-scoped templates cannot be set as global defaults.
ghostwriter/api/tests/test_hasura_metadata.py	Adds a metadata test to ensure template ID columns are not GraphQL-writable for user/manager.
CHANGELOG.md	Documents the security fix and the breaking GraphQL change.

[codecov]

Codecov Report

❌ Patch coverage is 97.66082% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.84%. Comparing base (b72e2fb) to head (0dcfc05).

Files with missing lines	Patch %	Lines
ghostwriter/commandcenter/forms.py	50.00%	2 Missing ⚠️
ghostwriter/reporting/archive.py	50.00%	2 Missing ⚠️
ghostwriter/reporting/forms.py	90.90%	2 Missing ⚠️
ghostwriter/reporting/views.py	92.85%	1 Missing ⚠️
ghostwriter/reporting/views2/report.py	94.44%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #919      +/-   ##
==========================================
+ Coverage   93.78%   93.84%   +0.06%     
==========================================
  Files         406      406              
  Lines       28006    28335     +329     
==========================================
+ Hits        26266    26592     +326     
- Misses       1740     1743       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 1 comment.