feat(api): RequireAuth+RequireProjectAccess middleware, IDOR-scope check/apply по projectID

2026-07-03 20:47:40 +07:00
parent 35ffe73ae3
commit 4533b0ca25
16 changed files with 498 additions and 143 deletions
@@ -13,9 +13,11 @@ import (
 )

 // LoadDomain joins domains+provider_accounts+templates to build the
-// service.DomainRef needed to check/apply a domain's DNS records.
-func (s *Store) LoadDomain(ctx context.Context, domainID uuid.UUID) (service.DomainRef, error) {
-	row, err := s.q.LoadDomainFull(ctx, domainID)
+// service.DomainRef needed to check/apply a domain's DNS records. Scoped by
+// projectID so a domain belonging to another tenant's project can never be
+// loaded, even if its domainID is guessed/leaked (closes IDOR).
+func (s *Store) LoadDomain(ctx context.Context, projectID, domainID uuid.UUID) (service.DomainRef, error) {
+	row, err := s.q.LoadDomainFull(ctx, db.LoadDomainFullParams{ID: domainID, ProjectID: projectID})
 	if err != nil {
 		return service.DomainRef{}, err
 	}