9a5479c2c7
1. HIGH — Socket.IO accepted client-supplied `auth.portId` in the
handshake without verifying the user actually held a role in that
port, then unconditionally joined the socket to `port:${portId}`.
The `join:entity` handler also skipped authorization. This let any
authenticated CRM user receive realtime events from any other
tenant: invoice numbers + totals + client names, document signer
emails, registration events with full client name + berth, file
uploads, etc. Auth middleware now resolves the user's
userPortRoles (or isSuperAdmin) before honouring portId, and
join:entity verifies the entity's port matches a port the user
has access to. Pre-existing pre-branch issue but fixed here given
the explicit "all data is extremely sensitive" directive.
2. MEDIUM — listCrmInvites issued a global SELECT with no port
scope. The crm_user_invites table has no portId column (invites
mint global better-auth users, then port roles are assigned
later). The previous gating on per-port admin.manage_users let
any director enumerate every other tenant's pending invitee
emails + isSuperAdmin flags — a phishing target list and a
super-admin onboarding timing oracle. Restrict GET (list),
DELETE (revoke), and POST resend to ctx.isSuperAdmin.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
29 lines
994 B
TypeScript
29 lines
994 B
TypeScript
import { NextResponse } from 'next/server';
|
|
|
|
import { withAuth, withPermission } from '@/lib/api/helpers';
|
|
import { errorResponse, ForbiddenError } from '@/lib/errors';
|
|
import { revokeCrmInvite } from '@/lib/services/crm-invite.service';
|
|
|
|
// Invites are a global resource (no portId column). Revoking a foreign
|
|
// tenant's pending invite by id would be cross-tenant tampering;
|
|
// restrict to super-admins to match the listing endpoint.
|
|
export const DELETE = withAuth(
|
|
withPermission('admin', 'manage_users', async (_req, ctx, params) => {
|
|
try {
|
|
if (!ctx.isSuperAdmin) {
|
|
throw new ForbiddenError('Revoking CRM invites requires super-admin');
|
|
}
|
|
const id = params.id ?? '';
|
|
await revokeCrmInvite(id, {
|
|
userId: ctx.userId,
|
|
portId: ctx.portId,
|
|
ipAddress: ctx.ipAddress,
|
|
userAgent: ctx.userAgent,
|
|
});
|
|
return NextResponse.json({ success: true });
|
|
} catch (error) {
|
|
return errorResponse(error);
|
|
}
|
|
}),
|
|
);
|