fix(webapp): chat access is organization-scoped everywhere

Chats belong to (organization, user); several queries enforced only the user,
so a user's own chat from another org could be opened, renamed, pinned or
appended to through a different org's route.

Author: kathiekiwi

apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.ts

@@ -153,8 +153,8 @@ export const loader = async ({ request, params }: LoaderFunctionArgs) => {
   const chatId = searchParams.get("chatId");
   if (chatId) {
     const [messages, session] = await Promise.all([
-      getChatMessages(dashboardAgentDb, { chatId, userId }),
-      getSession(dashboardAgentDb, { chatId, userId }),
+      getChatMessages(dashboardAgentDb, { chatId, userId, organizationId: project.organizationId }),
+      getSession(dashboardAgentDb, { chatId, userId, organizationId: project.organizationId }),
     ]);
     return json({ messages: messages ?? [], session });
   }
@@ -483,7 +483,12 @@ export const action = async ({ request, params }: ActionFunctionArgs) => {
       ],
     };
 
-    await appendChatMessage(dashboardAgentDb, { chatId: targetChatId, userId, message });
+    await appendChatMessage(dashboardAgentDb, {
+      chatId: targetChatId,
+      userId,
+      organizationId: project.organizationId,
+      message,
+    });
 
     return json({
       chatId: targetChatId,
@@ -554,14 +559,20 @@ export const action = async ({ request, params }: ActionFunctionArgs) => {
 
     case "rename": {
       if (!parsed.data.title) return json({ error: "title is required" }, { status: 400 });
-      await renameChat(dashboardAgentDb, { chatId, userId, title: parsed.data.title });
+      await renameChat(dashboardAgentDb, {
+        chatId,
+        userId,
+        organizationId: project.organizationId,
+        title: parsed.data.title,
+      });
       return json({ ok: true });
     }
 
     case "pin": {
       await setChatPinned(dashboardAgentDb, {
         chatId,
         userId,
+        organizationId: project.organizationId,
         pinned: parsed.data.pinned === "true",
       });
       return json({ ok: true });
@@ -570,7 +581,11 @@ export const action = async ({ request, params }: ActionFunctionArgs) => {
     // The user has this chat in front of them, so its watch wakes are seen. The
     // update is owner-scoped, so a chatId the caller doesn't own is a no-op.
     case "read": {
-      await markChatRead(dashboardAgentDb, { chatId, userId });
+      await markChatRead(dashboardAgentDb, {
+        chatId,
+        userId,
+        organizationId: project.organizationId,
+      });
       return json({ ok: true });
     }
 

internal-packages/dashboard-agent-db/src/queries.ts

@@ -85,13 +85,18 @@ export async function listChats(
  */
 export async function getChatMessages(
   db: DashboardAgentDb,
-  params: { chatId: string; userId: string }
+  params: { chatId: string; userId: string; organizationId: string }
 ): Promise<unknown[] | null> {
   const rows = await db
     .select({ messages: chats.messages })
     .from(chats)
     .where(
-      and(eq(chats.id, params.chatId), eq(chats.userId, params.userId), isNull(chats.deletedAt))
+      and(
+        eq(chats.id, params.chatId),
+        eq(chats.userId, params.userId),
+        eq(chats.organizationId, params.organizationId),
+        isNull(chats.deletedAt)
+      )
     )
     .limit(1);
   return rows[0]?.messages ?? null;
@@ -139,7 +144,7 @@ export async function countUserMessages(
  */
 export async function getSession(
   db: DashboardAgentDb,
-  params: { chatId: string; userId: string }
+  params: { chatId: string; userId: string; organizationId: string }
 ): Promise<ChatSession | null> {
   const rows = await db
     .select({
@@ -151,7 +156,13 @@ export async function getSession(
     })
     .from(chatSessions)
     .innerJoin(chats, eq(chats.id, chatSessions.chatId))
-    .where(and(eq(chatSessions.chatId, params.chatId), eq(chats.userId, params.userId)))
+    .where(
+      and(
+        eq(chatSessions.chatId, params.chatId),
+        eq(chats.userId, params.userId),
+        eq(chats.organizationId, params.organizationId)
+      )
+    )
     .limit(1);
   return rows[0] ?? null;
 }
@@ -213,12 +224,18 @@ export const ensureChat = createChat;
 /** #5 Rename. */
 export async function renameChat(
   db: DashboardAgentDb,
-  params: { chatId: string; userId: string; title: string }
+  params: { chatId: string; userId: string; organizationId: string; title: string }
 ): Promise<void> {
   await db
     .update(chats)
     .set({ title: params.title, updatedAt: sql`now()` })
-    .where(and(eq(chats.id, params.chatId), eq(chats.userId, params.userId)));
+    .where(
+      and(
+        eq(chats.id, params.chatId),
+        eq(chats.userId, params.userId),
+        eq(chats.organizationId, params.organizationId)
+      )
+    );
 }
 
 /**
@@ -241,12 +258,18 @@ export async function setChatTitleIfDefault(
 /** #5 Pin / unpin. */
 export async function setChatPinned(
   db: DashboardAgentDb,
-  params: { chatId: string; userId: string; pinned: boolean }
+  params: { chatId: string; userId: string; organizationId: string; pinned: boolean }
 ): Promise<void> {
   await db
     .update(chats)
     .set({ pinnedAt: params.pinned ? sql`now()` : null, updatedAt: sql`now()` })
-    .where(and(eq(chats.id, params.chatId), eq(chats.userId, params.userId)));
+    .where(
+      and(
+        eq(chats.id, params.chatId),
+        eq(chats.userId, params.userId),
+        eq(chats.organizationId, params.organizationId)
+      )
+    );
 }
 
 /**
@@ -255,12 +278,18 @@ export async function setChatPinned(
  */
 export async function markChatRead(
   db: DashboardAgentDb,
-  params: { chatId: string; userId: string; at?: Date }
+  params: { chatId: string; userId: string; organizationId: string; at?: Date }
 ): Promise<void> {
   await db
     .update(chats)
     .set({ lastReadAt: params.at ?? sql`now()` })
-    .where(and(eq(chats.id, params.chatId), eq(chats.userId, params.userId)));
+    .where(
+      and(
+        eq(chats.id, params.chatId),
+        eq(chats.userId, params.userId),
+        eq(chats.organizationId, params.organizationId)
+      )
+    );
 }
 
 /**
@@ -344,7 +373,7 @@ export async function persistMessages(
  */
 export async function appendChatMessage(
   db: DashboardAgentDb,
-  params: { chatId: string; userId: string; message: unknown }
+  params: { chatId: string; userId: string; organizationId: string; message: unknown }
 ): Promise<boolean> {
   const rows = await db
     .update(chats)
@@ -354,7 +383,12 @@ export async function appendChatMessage(
       updatedAt: sql`now()`,
     })
     .where(
-      and(eq(chats.id, params.chatId), eq(chats.userId, params.userId), isNull(chats.deletedAt))
+      and(
+        eq(chats.id, params.chatId),
+        eq(chats.userId, params.userId),
+        eq(chats.organizationId, params.organizationId),
+        isNull(chats.deletedAt)
+      )
     )
     .returning({ id: chats.id });