Show devices only for employees within the organization

[github-actions]

This is an automated pull request to merge chas/show-only-employe-devices into dev.
It was created by the [Auto Pull Request] action.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
app	Ready	Preview	Comment	Oct 16, 2025 2:52pm
portal	Ready	Preview	Comment	Oct 16, 2025 2:52pm

[comp-ai-code-review]

🔒 Comp AI - Security Review

🟡 Risk Level: MEDIUM

No OSV/CVE findings. In apps/app/src/app/(app)/[orgId]/people/devices/data/index.ts: unvalidated fleetDmLabelId and host IDs enable path-injection; Promise.all used without per-call error handling or concurrency control.

---

📦 Dependency Vulnerabilities

✅ No known vulnerabilities detected in dependencies.

---

🛡️ Code Security Analysis

View 1 file(s) with issues

🟡 apps/app/src/app/(app)/[orgId]/people/devices/data/index.ts (MEDIUM Risk)

#	Issue	Risk Level
1	Missing validation of employee fleetDmLabelId values	MEDIUM
2	Unvalidated host IDs inserted into fleet.get URL (path injection risk)	MEDIUM
3	No rate limiting/pagination: Promise.all on all hosts may cause DoS	MEDIUM
4	No error handling: any fleet.get failure rejects Promise.all	MEDIUM

Recommendations:

1. Validate/sanitize fleetDmLabelId before using it in path segments (e.g., enforce expected format such as a numeric ID or a validated UUID). Reject or canonicalize unexpected values.
2. Validate/encode host IDs before constructing paths (e.g., assert numeric type or use URL-safe encoding). Prefer passing IDs as query params or using client libraries that accept path segments safely.
3. Avoid firing unlimited parallel requests. Introduce batching or concurrency limits (use p-limit, p-map with concurrency, or similar). Implement pagination when listing hosts rather than loading all at once.
4. Wrap external calls in try/catch and/or use Promise.allSettled to return partial results when some requests fail. Log failures and surface an appropriate error/partial-response to the caller.
5. Consider applying input/schema validation at the point of data ingestion for fleetDmLabelId values so DB-stored label IDs are constrained to expected formats.

---

💡 Recommendations

View 3 recommendation(s)

1. Validate and canonicalize fleetDmLabelId before using it in a path segment (e.g., enforce /^\d+$/ or a UUID regex and reject unexpected values); or encode it with encodeURIComponent if it must be included in a URL path.
2. Validate/encode host IDs before inserting into fleet.get paths (e.g., assert type/format, then use encodeURIComponent or pass the ID as a parameter to the client API instead of concatenating into the path).
3. Avoid unbounded Promise.all on all hosts: use Promise.allSettled or a concurrency-controlled mapper (e.g., p-map/p-limit with a small concurrency value) and wrap each fleet.get call in try/catch so individual failures return partial results instead of rejecting the whole batch.

---

Powered by Comp AI - AI that handles compliance for you. Reviewed Oct 16, 2025

[claudfuen]

🎉 This PR is included in version 1.56.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀