Merge pull request #25 from hack-dance/codex/fix-authorization-bypass-for-team-management

fix(auth): restore team-scoped authorization

Author: roodboi

services/auth-broker/src/modules/orgs/service.ts

@@ -233,23 +233,19 @@ export class InMemoryOrgTeamsStore implements OrgTeamsStore {
     readonly orgKey: string | null;
     readonly actorUserId: string;
   }): MaybePromise<readonly TeamRecord[]> {
-    const allowedOrgIds = new Set(
-      [...this.activeMemberships.values()]
-        .filter(
-          (membership) =>
-            membership.scope === "organization" &&
-            membership.userId === input.actorUserId
-        )
-        .map((membership) => membership.organizationId)
-    );
     const organization = input.orgKey
       ? this.findOrganization({ orgKey: input.orgKey })
       : null;
     return [...this.teams.values()].filter((team) => {
       if (organization && team.organizationId !== organization.id) {
         return false;
       }
-      return allowedOrgIds.has(team.organizationId);
+      return [...this.activeMemberships.values()].some(
+        (membership) =>
+          membership.scope === "team" &&
+          membership.teamId === team.id &&
+          membership.userId === input.actorUserId
+      );
     });
   }
 
@@ -267,8 +263,8 @@ export class InMemoryOrgTeamsStore implements OrgTeamsStore {
     }
     const allowed = [...this.activeMemberships.values()].some(
       (membership) =>
-        membership.scope === "organization" &&
-        membership.organizationId === team.organizationId &&
+        membership.scope === "team" &&
+        membership.teamId === team.id &&
         membership.userId === input.actorUserId
     );
     return allowed ? team : null;

services/auth-broker/tests/org-team-membership.test.ts

@@ -249,7 +249,7 @@ describe("org and team membership broker routes", () => {
     expect(listMembersResponse.status).toBe(404);
   });
 
-  test("active org members can administer teams without direct team membership", async () => {
+  test("active org members cannot administer teams without direct team membership", async () => {
     const store = new InMemoryOrgTeamsStore();
     const ownerApp = createAuthBrokerApp({
       config: createTestConfig(),
@@ -300,27 +300,27 @@ describe("org and team membership broker routes", () => {
       })
     );
 
-    const orgAdminApp = createAuthBrokerApp({
+    const orgMemberApp = createAuthBrokerApp({
       config: createTestConfig(),
       betterAuthRuntime: createBetterAuthRuntimeWithSession(
         createSession({
           userId: "user-456",
-          email: "org-admin@example.com",
+          email: "org-member@example.com",
         })
       ),
       orgTeamsStore: store,
     });
 
-    const listTeamsResponse = await orgAdminApp.handle(
+    const listTeamsResponse = await orgMemberApp.handle(
       new Request("http://localhost/v1/auth/teams?org=hack")
     );
     expect(listTeamsResponse.status).toBe(200);
     const listedTeams = (await listTeamsResponse.json()) as {
       readonly teams?: ReadonlyArray<{ readonly slug?: string }>;
     };
-    expect(listedTeams.teams?.map((team) => team.slug)).toEqual(["cli"]);
+    expect(listedTeams.teams).toEqual([]);
 
-    const addTeamMemberResponse = await orgAdminApp.handle(
+    const addTeamMemberResponse = await orgMemberApp.handle(
       new Request("http://localhost/v1/auth/teams/cli/members/add", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -330,15 +330,7 @@ describe("org and team membership broker routes", () => {
         }),
       })
     );
-    expect(addTeamMemberResponse.status).toBe(200);
-    const addedMembership = (await addTeamMemberResponse.json()) as {
-      readonly membership?: {
-        readonly scope?: string;
-        readonly state?: string;
-      };
-    };
-    expect(addedMembership.membership?.scope).toBe("team");
-    expect(addedMembership.membership?.state).toBe("active");
+    expect(addTeamMemberResponse.status).toBe(404);
   });
 
   test("team membership changes require an active parent org membership", async () => {