fix(admin): fix bot workspace scoping (#12123)

* fix(admin): fix bot workspace scoping * pr comment
botpress · Sep 14, 2022 · 63bfa0d · 63bfa0d
1 parent d13adc4
commit 63bfa0d
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/packages/bp/src/admin/workspace/bots/bots-router.ts b/packages/bp/src/admin/workspace/bots/bots-router.ts
@@ -81,12 +81,23 @@ class BotsRouter extends CustomAdminRouter {
       })
     )
 
+    const assertBotInWorkspace = async (botId: string, workspaceId?: string) => {
+      const botExists = (await this.botService.getBotsIds()).includes(botId)
+      const isBotInCurrentWorkspace = (await this.workspaceService.getBotRefs(workspaceId)).includes(botId)
+
+      if (botExists && !isBotInCurrentWorkspace) {
+        throw new ConflictError(`Bot "${botId}" already exists in another workspace. Bot ID are unique server-wide`)
+      }
+    }
+
     router.post(
       '/',
       this.needPermissions('write', this.resource),
       this.asyncMiddleware(async (req, res) => {
         const bot = <BotConfig>_.pick(req.body, ['id', 'name', 'category', 'defaultLanguage'])
 
+        await assertBotInWorkspace(bot.id, req.workspace)
+
         const botExists = (await this.botService.getBotsIds()).includes(bot.id)
         const botLinked = (await this.workspaceService.getBotRefs()).includes(bot.id)
 
@@ -205,6 +216,8 @@ class BotsRouter extends CustomAdminRouter {
 
         const botId = await this.botService.makeBotId(req.params.botId, req.workspace!)
 
+        await assertBotInWorkspace(botId, req.workspace)
+
         const buffers: any[] = []
         req.on('data', chunk => buffers.push(chunk))
         await Promise.fromCallback(cb => req.on('end', cb))