fix(api,ui): remaining Tier-0 security hardening (#157-#164)

apps/api/internal/handler/label_test.go

@@ -1,9 +1,11 @@
 package handler_test
 
 import (
+	"context"
 	"net/http"
 	"testing"
 
+	"github.com/Devlaner/devlane/api/internal/model"
 	"github.com/Devlaner/devlane/api/internal/testutil"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -40,3 +42,29 @@ func TestLabel_CRUD(t *testing.T) {
 	rr4 := ts.DELETE(base+id+"/", w.Session)
 	require.Equal(t, http.StatusNoContent, rr4.Code)
 }
+
+// TestLabel_WorkspaceLevel_RejectsForeignWorkspace proves a workspace-level
+// label (ProjectID == nil) from a foreign workspace can't be read, updated,
+// or deleted just by supplying its UUID alongside any project in a workspace
+// the caller does belong to.
+func TestLabel_WorkspaceLevel_RejectsForeignWorkspace(t *testing.T) {
+	ts := testutil.NewTestServer(t)
+	w := testutil.SeedWorld(t, ts.DB)
+	base := "/api/workspaces/" + w.Workspace.Slug + "/projects/" + w.Project.ID.String() + "/issue-labels/"
+
+	otherOwner := testutil.CreateUser(t, ts.DB)
+	otherWs := testutil.CreateWorkspace(t, ts.DB, otherOwner.ID)
+	foreignLabel := &model.Label{
+		Name:        "foreign workspace label",
+		Color:       "#00ff00",
+		ProjectID:   nil,
+		WorkspaceID: otherWs.ID,
+	}
+	require.NoError(t, ts.DB.WithContext(context.Background()).Create(foreignLabel).Error)
+
+	rr := ts.PATCH(base+foreignLabel.ID.String()+"/", map[string]any{"name": "hijacked"}, w.Session)
+	require.Equal(t, http.StatusNotFound, rr.Code, "body=%s", rr.Body.String())
+
+	rr2 := ts.DELETE(base+foreignLabel.ID.String()+"/", w.Session)
+	require.Equal(t, http.StatusNotFound, rr2.Code, "body=%s", rr2.Body.String())
+}

apps/api/internal/service/label.go

@@ -22,39 +22,39 @@ func NewLabelService(ls *store.LabelStore, ps *store.ProjectStore, ws *store.Wor
 	return &LabelService{ls: ls, ps: ps, ws: ws}
 }
 
-func (s *LabelService) ensureProjectAccess(ctx context.Context, workspaceSlug string, projectID uuid.UUID, userID uuid.UUID) error {
+func (s *LabelService) ensureProjectAccess(ctx context.Context, workspaceSlug string, projectID uuid.UUID, userID uuid.UUID) (uuid.UUID, error) {
 	wrk, err := s.ws.GetBySlug(ctx, workspaceSlug)
 	if err != nil {
-		return ErrProjectForbidden
+		return uuid.Nil, ErrProjectForbidden
 	}
 	ok, _ := s.ws.IsMember(ctx, wrk.ID, userID)
 	if !ok {
-		return ErrProjectForbidden
+		return uuid.Nil, ErrProjectForbidden
 	}
 	inWorkspace, _ := s.ps.IsInWorkspace(ctx, projectID, wrk.ID)
 	if !inWorkspace {
-		return ErrProjectNotFound
+		return uuid.Nil, ErrProjectNotFound
 	}
-	return nil
+	return wrk.ID, nil
 }
 
 func (s *LabelService) ListByProject(ctx context.Context, workspaceSlug string, projectID uuid.UUID, userID uuid.UUID) ([]model.Label, error) {
-	if err := s.ensureProjectAccess(ctx, workspaceSlug, projectID, userID); err != nil {
+	if _, err := s.ensureProjectAccess(ctx, workspaceSlug, projectID, userID); err != nil {
 		return nil, err
 	}
 	return s.ls.ListByProjectID(ctx, projectID)
 }
 
 func (s *LabelService) Create(ctx context.Context, workspaceSlug string, projectID uuid.UUID, userID uuid.UUID, name, color string) (*model.Label, error) {
-	if err := s.ensureProjectAccess(ctx, workspaceSlug, projectID, userID); err != nil {
+	workspaceID, err := s.ensureProjectAccess(ctx, workspaceSlug, projectID, userID)
+	if err != nil {
 		return nil, err
 	}
-	wrk, _ := s.ws.GetBySlug(ctx, workspaceSlug)
 	l := &model.Label{
 		Name:        name,
 		Color:       color,
 		ProjectID:   &projectID,
-		WorkspaceID: wrk.ID,
+		WorkspaceID: workspaceID,
 	}
 	if err := s.ls.Create(ctx, l); err != nil {
 		return nil, err
@@ -63,13 +63,20 @@ func (s *LabelService) Create(ctx context.Context, workspaceSlug string, project
 }
 
 func (s *LabelService) GetByID(ctx context.Context, workspaceSlug string, projectID, labelID uuid.UUID, userID uuid.UUID) (*model.Label, error) {
-	if err := s.ensureProjectAccess(ctx, workspaceSlug, projectID, userID); err != nil {
+	workspaceID, err := s.ensureProjectAccess(ctx, workspaceSlug, projectID, userID)
+	if err != nil {
 		return nil, err
 	}
 	l, err := s.ls.GetByID(ctx, labelID)
 	if err != nil {
 		return nil, ErrLabelNotFound
 	}
+	// A label's workspace must match the caller's resolved workspace — this is
+	// what actually protects workspace-level labels (ProjectID == nil), which
+	// the project-scoped check below can't see.
+	if l.WorkspaceID != workspaceID {
+		return nil, ErrLabelNotFound
+	}
 	if l.ProjectID != nil && *l.ProjectID != projectID {
 		return nil, ErrLabelNotFound
 	}