feat(api): RequireAuth+RequireProjectAccess middleware, IDOR-scope check/apply по projectID

2026-07-03 20:47:40 +07:00
parent 35ffe73ae3
commit 4533b0ca25
16 changed files with 498 additions and 143 deletions
@@ -27,4 +27,4 @@ SELECT d.zone_id, a.provider, a.secret_enc, t.doc
 FROM domains d
 JOIN provider_accounts a ON a.id = d.provider_account_id
 LEFT JOIN templates t ON t.id = d.template_id
-WHERE d.id = $1;
+WHERE d.id = $1 AND d.project_id = $2;