Dokploy/dokploy
1
0
Fork 0
mirror of https://github.com/Dokploy/dokploy.git synced 2026-07-21 22:05:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

Reapply "feat(security): enforce service-level access on docker WebSocket handlers"

Browse Source 
This reverts commit 56169f3278.
This commit is contained in:
Mauricio Siu
2026-07-20 00:35:40 -06:00
parent 56169f3278
commit 1bc76e9e5b
14 changed files with 51 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
apps/dokploy/__test__/wss/authorize.test.ts
View File

@@ -3,9 +3,11 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
// Mock the permission + server helpers the wss authorizer composes.
const mockHasPermission = vi.hoisted(() => vi.fn());
const mockFindMember = vi.hoisted(() => vi.fn());
const mockCheckServiceAccess = vi.hoisted(() => vi.fn());
vi.mock("@dokploy/server/services/permission", () => ({
hasPermission: mockHasPermission,
findMemberByUserId: mockFindMember,
checkServiceAccess: mockCheckServiceAccess,
}));
const mockGetAccessibleServerIds = vi.hoisted(() => vi.fn());
@@ -52,6 +54,22 @@ describe("canAccessDockerOverWss", () => {
mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
expect(await canAccessDockerOverWss(USER, SESSION, "srv-1")).toBe(true);
});
it("denies when the container belongs to a service the caller cannot access", async () => {
mockHasPermission.mockResolvedValue(true);
mockCheckServiceAccess.mockRejectedValue(new Error("no access"));
expect(await canAccessDockerOverWss(USER, SESSION, null, "svc-1")).toBe(
false,
);
});
it("allows when the caller has access to the container's service", async () => {
mockHasPermission.mockResolvedValue(true);
mockCheckServiceAccess.mockResolvedValue(undefined);
expect(await canAccessDockerOverWss(USER, SESSION, null, "svc-1")).toBe(
true,
);
});
});
describe("canAccessTerminalOverWss", () => {