Dokploy/dokploy
1
0
Fork 0
mirror of https://github.com/Dokploy/dokploy.git synced 2026-06-15 20:25:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: add organization-level authorization checks to WebSocket servers

Browse Source 
- Implemented checks in the WebSocket server setups for Docker container logs, terminal, and deployment logs to ensure users can only access resources associated with their active organization.
- Enhanced security by closing WebSocket connections if the organization ID does not match the session's active organization ID.
This commit is contained in:
Mauricio Siu
2026-04-24 12:47:51 -06:00
parent 018e2b153e
commit 232ccc9139
1 changed files with 36 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

66
apps/dokploy/server/api/routers/cluster.ts
View File

@@ -11,20 +11,6 @@ import { audit } from "@/server/api/utils/audit";
import { getLocalServerIp } from "@/server/wss/terminal";
import { createTRPCRouter, withPermission } from "../trpc";
const assertServerBelongsToOrg = async (
serverId: string | undefined,
activeOrganizationId: string,
) => {
if (!serverId) return;
const targetServer = await findServerById(serverId);
if (targetServer.organizationId !== activeOrganizationId) {
throw new TRPCError({
code: "UNAUTHORIZED",
message: "You don't have access to this server.",
});
}
};
export const clusterRouter = createTRPCRouter({
getNodes: withPermission("server", "read")
.input(
@@ -33,10 +19,15 @@ export const clusterRouter = createTRPCRouter({
}),
)
.query(async ({ input, ctx }) => {
await assertServerBelongsToOrg(
input.serverId,
ctx.session.activeOrganizationId,
);
if (input.serverId) {
const targetServer = await findServerById(input.serverId);
if (targetServer.organizationId !== ctx.session.activeOrganizationId) {
throw new TRPCError({
code: "UNAUTHORIZED",
message: "You don't have access to this server.",
});
}
}
const docker = await getRemoteDocker(input.serverId);
const workers: DockerNode[] = await docker.listNodes();
return workers;
@@ -50,10 +41,15 @@ export const clusterRouter = createTRPCRouter({
}),
)
.mutation(async ({ input, ctx }) => {
await assertServerBelongsToOrg(
input.serverId,
ctx.session.activeOrganizationId,
);
if (input.serverId) {
const targetServer = await findServerById(input.serverId);
if (targetServer.organizationId !== ctx.session.activeOrganizationId) {
throw new TRPCError({
code: "UNAUTHORIZED",
message: "You don't have access to this server.",
});
}
}
try {
const drainCommand = `docker node update --availability drain ${input.nodeId}`;
const removeCommand = `docker node rm ${input.nodeId} --force`;
@@ -88,10 +84,15 @@ export const clusterRouter = createTRPCRouter({
}),
)
.query(async ({ input, ctx }) => {
await assertServerBelongsToOrg(
input.serverId,
ctx.session.activeOrganizationId,
);
if (input.serverId) {
const targetServer = await findServerById(input.serverId);
if (targetServer.organizationId !== ctx.session.activeOrganizationId) {
throw new TRPCError({
code: "UNAUTHORIZED",
message: "You don't have access to this server.",
});
}
}
const docker = await getRemoteDocker(input.serverId);
const result = await docker.swarmInspect();
const docker_version = await docker.version();
@@ -115,10 +116,15 @@ export const clusterRouter = createTRPCRouter({
}),
)
.query(async ({ input, ctx }) => {
await assertServerBelongsToOrg(
input.serverId,
ctx.session.activeOrganizationId,
);
if (input.serverId) {
const targetServer = await findServerById(input.serverId);
if (targetServer.organizationId !== ctx.session.activeOrganizationId) {
throw new TRPCError({
code: "UNAUTHORIZED",
message: "You don't have access to this server.",
});
}
}
const docker = await getRemoteDocker(input.serverId);
const result = await docker.swarmInspect();
const docker_version = await docker.version();