fix(api,ui): remaining Tier-0 security hardening (#157-#164)

apps/api/internal/handler/join_test.go

@@ -0,0 +1,91 @@
+package handler_test
+
+import (
+	"context"
+	"net/http"
+	"testing"
+
+	"github.com/Devlaner/devlane/api/internal/model"
+	"github.com/Devlaner/devlane/api/internal/testutil"
+	"github.com/stretchr/testify/require"
+)
+
+// TestWorkspace_JoinByToken_RejectsEmailMismatch proves a workspace invite
+// token can't be redeemed by an account whose email doesn't match the
+// invited email (a leaked/forwarded token must not grant membership).
+func TestWorkspace_JoinByToken_RejectsEmailMismatch(t *testing.T) {
+	ts := testutil.NewTestServer(t)
+	owner := testutil.CreateUser(t, ts.DB)
+	w := testutil.CreateWorkspace(t, ts.DB, owner.ID)
+	inv := testutil.CreateWorkspaceInvite(t, ts.DB, w.ID, "invited@test.local", "tok-mismatch-111")
+
+	stranger := testutil.CreateUser(t, ts.DB) // email is stranger-N@test.local, not invited@test.local
+	session := testutil.LoginAs(t, ts.DB, stranger)
+
+	rr := ts.POST("/api/workspaces/join/", map[string]any{"token": inv.Token}, session)
+	require.Equal(t, http.StatusNotFound, rr.Code, "body=%s", rr.Body.String())
+}
+
+// TestWorkspace_JoinByToken_AcceptsEmailMatch proves the happy path still
+// works when the joining account's email matches the invite.
+func TestWorkspace_JoinByToken_AcceptsEmailMatch(t *testing.T) {
+	ts := testutil.NewTestServer(t)
+	owner := testutil.CreateUser(t, ts.DB)
+	w := testutil.CreateWorkspace(t, ts.DB, owner.ID)
+
+	invitee := testutil.CreateUser(t, ts.DB)
+	email := invitee.Email
+	require.NotNil(t, email)
+	inv := testutil.CreateWorkspaceInvite(t, ts.DB, w.ID, *email, "tok-match-111")
+	session := testutil.LoginAs(t, ts.DB, invitee)
+
+	rr := ts.POST("/api/workspaces/join/", map[string]any{"token": inv.Token}, session)
+	require.Equal(t, http.StatusOK, rr.Code, "body=%s", rr.Body.String())
+}
+
+func TestProject_JoinByToken_RejectsEmailMismatch(t *testing.T) {
+	ts := testutil.NewTestServer(t)
+	owner := testutil.CreateUser(t, ts.DB)
+	w := testutil.CreateWorkspace(t, ts.DB, owner.ID)
+	p := testutil.CreateProject(t, ts.DB, w.ID, owner.ID)
+
+	inv := &model.ProjectMemberInvite{
+		ProjectID:   p.ID,
+		WorkspaceID: w.ID,
+		Email:       "invited@test.local",
+		Token:       "proj-tok-mismatch-111",
+		Role:        testutil.RoleMember,
+	}
+	require.NoError(t, ts.DB.WithContext(context.Background()).Create(inv).Error)
+
+	stranger := testutil.CreateUser(t, ts.DB)
+	session := testutil.LoginAs(t, ts.DB, stranger)
+
+	rr := ts.POST("/api/workspaces/"+w.Slug+"/projects/join/", map[string]any{"token": inv.Token}, session)
+	require.Equal(t, http.StatusNotFound, rr.Code, "body=%s", rr.Body.String())
+}
+
+func TestProject_JoinByToken_AcceptsEmailMatch(t *testing.T) {
+	ts := testutil.NewTestServer(t)
+	owner := testutil.CreateUser(t, ts.DB)
+	w := testutil.CreateWorkspace(t, ts.DB, owner.ID)
+	p := testutil.CreateProject(t, ts.DB, w.ID, owner.ID)
+
+	invitee := testutil.CreateUser(t, ts.DB)
+	testutil.AddWorkspaceMember(t, ts.DB, w.ID, invitee.ID, testutil.RoleMember)
+	email := invitee.Email
+	require.NotNil(t, email)
+
+	inv := &model.ProjectMemberInvite{
+		ProjectID:   p.ID,
+		WorkspaceID: w.ID,
+		Email:       *email,
+		Token:       "proj-tok-match-111",
+		Role:        testutil.RoleMember,
+	}
+	require.NoError(t, ts.DB.WithContext(context.Background()).Create(inv).Error)
+
+	session := testutil.LoginAs(t, ts.DB, invitee)
+	rr := ts.POST("/api/workspaces/"+w.Slug+"/projects/join/", map[string]any{"token": inv.Token}, session)
+	require.Equal(t, http.StatusOK, rr.Code, "body=%s", rr.Body.String())
+}

apps/api/internal/handler/label_test.go

@@ -1,9 +1,11 @@
 package handler_test
 
 import (
+	"context"
 	"net/http"
 	"testing"
 
+	"github.com/Devlaner/devlane/api/internal/model"
 	"github.com/Devlaner/devlane/api/internal/testutil"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -40,3 +42,29 @@ func TestLabel_CRUD(t *testing.T) {
 	rr4 := ts.DELETE(base+id+"/", w.Session)
 	require.Equal(t, http.StatusNoContent, rr4.Code)
 }
+
+// TestLabel_WorkspaceLevel_RejectsForeignWorkspace proves a workspace-level
+// label (ProjectID == nil) from a foreign workspace can't be read, updated,
+// or deleted just by supplying its UUID alongside any project in a workspace
+// the caller does belong to.
+func TestLabel_WorkspaceLevel_RejectsForeignWorkspace(t *testing.T) {
+	ts := testutil.NewTestServer(t)
+	w := testutil.SeedWorld(t, ts.DB)
+	base := "/api/workspaces/" + w.Workspace.Slug + "/projects/" + w.Project.ID.String() + "/issue-labels/"
+
+	otherOwner := testutil.CreateUser(t, ts.DB)
+	otherWs := testutil.CreateWorkspace(t, ts.DB, otherOwner.ID)
+	foreignLabel := &model.Label{
+		Name:        "foreign workspace label",
+		Color:       "#00ff00",
+		ProjectID:   nil,
+		WorkspaceID: otherWs.ID,
+	}
+	require.NoError(t, ts.DB.WithContext(context.Background()).Create(foreignLabel).Error)
+
+	rr := ts.PATCH(base+foreignLabel.ID.String()+"/", map[string]any{"name": "hijacked"}, w.Session)
+	require.Equal(t, http.StatusNotFound, rr.Code, "body=%s", rr.Body.String())
+
+	rr2 := ts.DELETE(base+foreignLabel.ID.String()+"/", w.Session)
+	require.Equal(t, http.StatusNotFound, rr2.Code, "body=%s", rr2.Body.String())
+}

apps/api/internal/service/label.go

@@ -22,39 +22,39 @@ func NewLabelService(ls *store.LabelStore, ps *store.ProjectStore, ws *store.Wor
 	return &LabelService{ls: ls, ps: ps, ws: ws}
 }
 
-func (s *LabelService) ensureProjectAccess(ctx context.Context, workspaceSlug string, projectID uuid.UUID, userID uuid.UUID) error {
+func (s *LabelService) ensureProjectAccess(ctx context.Context, workspaceSlug string, projectID uuid.UUID, userID uuid.UUID) (uuid.UUID, error) {
 	wrk, err := s.ws.GetBySlug(ctx, workspaceSlug)
 	if err != nil {
-		return ErrProjectForbidden
+		return uuid.Nil, ErrProjectForbidden
 	}
 	ok, _ := s.ws.IsMember(ctx, wrk.ID, userID)
 	if !ok {
-		return ErrProjectForbidden
+		return uuid.Nil, ErrProjectForbidden
 	}
 	inWorkspace, _ := s.ps.IsInWorkspace(ctx, projectID, wrk.ID)
 	if !inWorkspace {
-		return ErrProjectNotFound
+		return uuid.Nil, ErrProjectNotFound
 	}
-	return nil
+	return wrk.ID, nil
 }
 
 func (s *LabelService) ListByProject(ctx context.Context, workspaceSlug string, projectID uuid.UUID, userID uuid.UUID) ([]model.Label, error) {
-	if err := s.ensureProjectAccess(ctx, workspaceSlug, projectID, userID); err != nil {
+	if _, err := s.ensureProjectAccess(ctx, workspaceSlug, projectID, userID); err != nil {
 		return nil, err
 	}
 	return s.ls.ListByProjectID(ctx, projectID)
 }
 
 func (s *LabelService) Create(ctx context.Context, workspaceSlug string, projectID uuid.UUID, userID uuid.UUID, name, color string) (*model.Label, error) {
-	if err := s.ensureProjectAccess(ctx, workspaceSlug, projectID, userID); err != nil {
+	workspaceID, err := s.ensureProjectAccess(ctx, workspaceSlug, projectID, userID)
+	if err != nil {
 		return nil, err
 	}
-	wrk, _ := s.ws.GetBySlug(ctx, workspaceSlug)
 	l := &model.Label{
 		Name:        name,
 		Color:       color,
 		ProjectID:   &projectID,
-		WorkspaceID: wrk.ID,
+		WorkspaceID: workspaceID,
 	}
 	if err := s.ls.Create(ctx, l); err != nil {
 		return nil, err
@@ -63,13 +63,20 @@ func (s *LabelService) Create(ctx context.Context, workspaceSlug string, project
 }
 
 func (s *LabelService) GetByID(ctx context.Context, workspaceSlug string, projectID, labelID uuid.UUID, userID uuid.UUID) (*model.Label, error) {
-	if err := s.ensureProjectAccess(ctx, workspaceSlug, projectID, userID); err != nil {
+	workspaceID, err := s.ensureProjectAccess(ctx, workspaceSlug, projectID, userID)
+	if err != nil {
 		return nil, err
 	}
 	l, err := s.ls.GetByID(ctx, labelID)
 	if err != nil {
 		return nil, ErrLabelNotFound
 	}
+	// A label's workspace must match the caller's resolved workspace — this is
+	// what actually protects workspace-level labels (ProjectID == nil), which
+	// the project-scoped check below can't see.
+	if l.WorkspaceID != workspaceID {
+		return nil, ErrLabelNotFound
+	}
 	if l.ProjectID != nil && *l.ProjectID != projectID {
 		return nil, ErrLabelNotFound
 	}

apps/api/internal/service/project.go

@@ -11,6 +11,7 @@ import (
 	"github.com/Devlaner/devlane/api/internal/model"
 	"github.com/Devlaner/devlane/api/internal/store"
 	"github.com/google/uuid"
+	"gorm.io/gorm"
 )
 
 var (
@@ -353,6 +354,17 @@ func (s *ProjectService) DeleteInvite(ctx context.Context, workspaceSlug string,
 	return s.pinv.Delete(ctx, inviteID)
 }
 
+// requireInviteEmailMatch ensures the authenticated user's email matches the
+// invite's email, so a leaked/forwarded token can't be redeemed by a
+// different account.
+func (s *ProjectService) requireInviteEmailMatch(ctx context.Context, inviteEmail string, userID uuid.UUID) error {
+	u, err := s.us.GetByID(ctx, userID)
+	if err != nil || u.Email == nil || !strings.EqualFold(*u.Email, inviteEmail) {
+		return ErrInviteNotFound
+	}
+	return nil
+}
+
 func (s *ProjectService) JoinByToken(ctx context.Context, token string, userID uuid.UUID) (*model.Project, error) {
 	inv, err := s.pinv.GetByToken(ctx, token)
 	if err != nil || inv == nil {
@@ -362,10 +374,19 @@ func (s *ProjectService) JoinByToken(ctx context.Context, token string, userID u
 	if err != nil {
 		return nil, ErrProjectNotFound
 	}
+	if err := s.requireInviteEmailMatch(ctx, inv.Email, userID); err != nil {
+		return nil, err
+	}
 	inv.Accepted = true
-	_ = s.pinv.Update(ctx, inv)
-	m := &model.ProjectMember{ProjectID: p.ID, WorkspaceID: p.WorkspaceID, MemberID: &userID, Role: inv.Role}
-	_ = s.ps.AddProjectMember(ctx, m)
+	if err := s.ps.Transaction(ctx, func(tx *gorm.DB) error {
+		if err := tx.Save(inv).Error; err != nil {
+			return err
+		}
+		m := &model.ProjectMember{ProjectID: p.ID, WorkspaceID: p.WorkspaceID, MemberID: &userID, Role: inv.Role}
+		return tx.Create(m).Error
+	}); err != nil {
+		return nil, err
+	}
 	return p, nil
 }
 
@@ -378,10 +399,19 @@ func (s *ProjectService) JoinByInviteID(ctx context.Context, workspaceSlug strin
 	if err != nil || inv.ProjectID != p.ID || inv.Accepted {
 		return nil, ErrInviteNotFound
 	}
+	if err := s.requireInviteEmailMatch(ctx, inv.Email, userID); err != nil {
+		return nil, err
+	}
 	inv.Accepted = true
-	_ = s.pinv.Update(ctx, inv)
-	m := &model.ProjectMember{ProjectID: p.ID, WorkspaceID: p.WorkspaceID, MemberID: &userID, Role: inv.Role}
-	_ = s.ps.AddProjectMember(ctx, m)
+	if err := s.ps.Transaction(ctx, func(tx *gorm.DB) error {
+		if err := tx.Save(inv).Error; err != nil {
+			return err
+		}
+		m := &model.ProjectMember{ProjectID: p.ID, WorkspaceID: p.WorkspaceID, MemberID: &userID, Role: inv.Role}
+		return tx.Create(m).Error
+	}); err != nil {
+		return nil, err
+	}
 	return p, nil
 }
 

apps/api/internal/service/workspace.go

@@ -11,6 +11,7 @@ import (
 	"github.com/Devlaner/devlane/api/internal/model"
 	"github.com/Devlaner/devlane/api/internal/store"
 	"github.com/google/uuid"
+	"gorm.io/gorm"
 )
 
 var (
@@ -296,6 +297,17 @@ func (s *WorkspaceService) DeleteInvite(ctx context.Context, slug string, invite
 	return s.winv.Delete(ctx, inviteID)
 }
 
+// requireInviteEmailMatch ensures the authenticated user's email matches the
+// invite's email, so a leaked/forwarded token can't be redeemed by a
+// different account.
+func (s *WorkspaceService) requireInviteEmailMatch(ctx context.Context, inviteEmail string, userID uuid.UUID) error {
+	u, err := s.us.GetByID(ctx, userID)
+	if err != nil || u.Email == nil || !strings.EqualFold(*u.Email, inviteEmail) {
+		return ErrInviteNotFound
+	}
+	return nil
+}
+
 func (s *WorkspaceService) JoinByToken(ctx context.Context, token string, userID uuid.UUID) (*model.Workspace, error) {
 	inv, err := s.winv.GetByToken(ctx, token)
 	if err != nil || inv == nil {
@@ -305,10 +317,19 @@ func (s *WorkspaceService) JoinByToken(ctx context.Context, token string, userID
 	if err != nil {
 		return nil, ErrWorkspaceNotFound
 	}
+	if err := s.requireInviteEmailMatch(ctx, inv.Email, userID); err != nil {
+		return nil, err
+	}
 	inv.Accepted = true
-	_ = s.winv.Update(ctx, inv)
-	m := &model.WorkspaceMember{WorkspaceID: w.ID, MemberID: userID, Role: inv.Role}
-	_ = s.ws.AddMember(ctx, m)
+	if err := s.ws.Transaction(ctx, func(tx *gorm.DB) error {
+		if err := tx.Save(inv).Error; err != nil {
+			return err
+		}
+		m := &model.WorkspaceMember{WorkspaceID: w.ID, MemberID: userID, Role: inv.Role}
+		return tx.Create(m).Error
+	}); err != nil {
+		return nil, err
+	}
 	return w, nil
 }
 
@@ -322,10 +343,19 @@ func (s *WorkspaceService) JoinByInviteID(ctx context.Context, slug string, invi
 	if err != nil || inv.WorkspaceID != w.ID || inv.Accepted {
 		return nil, ErrInviteNotFound
 	}
+	if err := s.requireInviteEmailMatch(ctx, inv.Email, userID); err != nil {
+		return nil, err
+	}
 	inv.Accepted = true
-	_ = s.winv.Update(ctx, inv)
-	m := &model.WorkspaceMember{WorkspaceID: w.ID, MemberID: userID, Role: inv.Role}
-	_ = s.ws.AddMember(ctx, m)
+	if err := s.ws.Transaction(ctx, func(tx *gorm.DB) error {
+		if err := tx.Save(inv).Error; err != nil {
+			return err
+		}
+		m := &model.WorkspaceMember{WorkspaceID: w.ID, MemberID: userID, Role: inv.Role}
+		return tx.Create(m).Error
+	}); err != nil {
+		return nil, err
+	}
 	return w, nil
 }
 

apps/api/internal/store/project.go

@@ -13,6 +13,11 @@ type ProjectStore struct{ db *gorm.DB }
 
 func NewProjectStore(db *gorm.DB) *ProjectStore { return &ProjectStore{db: db} }
 
+// Transaction runs fn inside a DB transaction (same connection).
+func (s *ProjectStore) Transaction(ctx context.Context, fn func(tx *gorm.DB) error) error {
+	return s.db.WithContext(ctx).Transaction(fn)
+}
+
 func (s *ProjectStore) Create(ctx context.Context, p *model.Project) error {
 	return s.db.WithContext(ctx).Create(p).Error
 }

apps/api/internal/store/workspace.go

@@ -13,6 +13,11 @@ type WorkspaceStore struct{ db *gorm.DB }
 
 func NewWorkspaceStore(db *gorm.DB) *WorkspaceStore { return &WorkspaceStore{db: db} }
 
+// Transaction runs fn inside a DB transaction (same connection).
+func (s *WorkspaceStore) Transaction(ctx context.Context, fn func(tx *gorm.DB) error) error {
+	return s.db.WithContext(ctx).Transaction(fn)
+}
+
 func (s *WorkspaceStore) Create(ctx context.Context, w *model.Workspace) error {
 	return s.db.WithContext(ctx).Create(w).Error
 }