Merge pull request #3625 from activepieces/fix/app-credentials-authz

fix(authz): remove project check for list app-credentials endpoint
activepieces · Jan 14, 2024 · a5f4e7c · a5f4e7c
2 parents 44e8843 + e0d07ec
commit a5f4e7c
Show file tree

Hide file tree

Showing 4 changed files with 14 additions and 3 deletions.
diff --git a/.github/workflows/build-cloud-image.yml b/.github/workflows/build-cloud-image.yml
@@ -6,7 +6,7 @@ on:
 jobs:
   Release:
     env:
-      MY_VERSION: sign2
+      MY_VERSION: sign3
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository code

diff --git a/packages/backend/src/app/core/security/authz/project-authz-handler.ts b/packages/backend/src/app/core/security/authz/project-authz-handler.ts
@@ -8,6 +8,7 @@ export class ProjectAuthzHandler extends BaseSecurityHandler {
         '/v1/users/projects/:projectId/token',
         '/v1/admin/platforms',
         '/v1/admin/pieces',
+        '/v1/app-credentials',
     ]
 
     protected canHandle(request: FastifyRequest): Promise<boolean> {

diff --git a/packages/backend/src/app/ee/app-credentials/app-credentials.module.ts b/packages/backend/src/app/ee/app-credentials/app-credentials.module.ts
@@ -57,7 +57,11 @@ const appCredentialController: FastifyPluginAsyncTypebox = async (fastify) => {
             }>,
             reply,
         ) => {
-            await appCredentialService.delete(request.params.credentialId)
+            await appCredentialService.delete({
+                id: request.params.credentialId,
+                projectId: request.principal.projectId,
+            })
+
             return reply.status(StatusCodes.OK).send()
         },
     )

diff --git a/packages/backend/src/app/ee/app-credentials/app-credentials.service.ts b/packages/backend/src/app/ee/app-credentials/app-credentials.service.ts
@@ -38,9 +38,15 @@ export const appCredentialService = {
         }, ['projectId', 'appName'])
         return appCredentialRepo.findOneBy({ projectId, appName: request.appName })
     },
-    async delete(id: AppCredentialId): Promise<void> {
+    async delete({ id, projectId }: DeleteParams): Promise<void> {
         await appCredentialRepo.delete({
             id,
+            projectId,
         })
     },
 }
+
+type DeleteParams = {
+    id: AppCredentialId
+    projectId: ProjectId
+}