fix cross-tenant dashboard read and service-map stored xss

[Polliog]

Fixes two privately-reported security issues (coordinated disclosure via KIberblick.de), both validated against current code.

1. Cross-tenant read on dashboard endpoints (high)

The dashboard endpoints took organizationId from the query string and only ran the org-membership check behind if (request.user?.id), which is set for session auth only. For API-key auth requireFullAccess lets any non-write key through without setting request.user, so the check was skipped and the org was read from the attacker-supplied query rather than the key's bound request.organizationId; with projectId omitted the project-in-org check was skipped too. A holder of any full-access API key (bound to org A) could read another organization's dashboard data.

Fix: all handlers now route through a shared resolveDashboardScope. For API-key auth it requires the requested org to match the key's bound org and the requested project to match (defaulting to the key's bound project when omitted), mirroring resolveQueryProjectId which already protects the query and traces routes. Session auth keeps the org-membership and project-in-org checks.

This also covers GET /api/v1/dashboard/activity-overview, which had the same flaw and was not in the original report.

Endpoints: /stats, /timeseries, /top-services, /timeline-events, /recent-errors, /activity-overview.

2. Stored XSS via OTLP service.name in the service map (high)

service.name from ingested traces passed through sanitizeForPostgres (null bytes only), so < > " ' survived into span.service_name. ServiceMap.svelte's ECharts tooltip.formatter returned raw HTML built from params.name / params.data.source / params.data.target, and ECharts renders tooltip output as HTML, so a service.name like <img src=x onerror=...> executed for any operator hovering the node/edge.

Fix: user-derived tooltip values are HTML-escaped via a shared escapeHtml util (also adopted by the SIEM HTML report builder, replacing its private copy). Stored data is left raw on purpose: escaping at the sink avoids double-encoding and keeps the JSON API correct.

Tests

• Backend dashboard routes: 36/36 pass, including 6 new API-key isolation cases (cross-org 403 on every endpoint, foreign-project 403, project scoping).
• Frontend escapeHtml unit test: 5/5 pass (incl. <img onerror> payload).
• svelte-check: 9 errors = pre-existing baseline, no new errors.

No database migrations.

[codecov]

Codecov Report

❌ Patch coverage is 98.27586% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
packages/backend/src/modules/dashboard/routes.ts	98.27%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!