From aff200f84f30647658149b6487feca7a86f25ac5 Mon Sep 17 00:00:00 2001 From: Mauricio Siu Date: Wed, 13 May 2026 00:09:47 -0600 Subject: [PATCH] feat(deployment): add server access validation for deployment actions - Implemented server access validation in deployment procedures to ensure users can only access deployments associated with their active organization. - Added checks to throw an UNAUTHORIZED error if a user attempts to access a deployment linked to a server outside their organization. This enhancement improves security and access control within the deployment management system. --- apps/dokploy/server/api/routers/deployment.ts | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/apps/dokploy/server/api/routers/deployment.ts b/apps/dokploy/server/api/routers/deployment.ts index f91b67b40..d17a04dfb 100644 --- a/apps/dokploy/server/api/routers/deployment.ts +++ b/apps/dokploy/server/api/routers/deployment.ts @@ -151,6 +151,14 @@ export const deploymentRouter = createTRPCRouter({ await checkServicePermissionAndAccess(ctx, serviceId, { deployment: ["cancel"], }); + } else if (deployment.schedule?.serverId) { + const targetServer = await findServerById(deployment.schedule.serverId); + if (targetServer.organizationId !== ctx.session.activeOrganizationId) { + throw new TRPCError({ + code: "UNAUTHORIZED", + message: "You don't have access to this deployment.", + }); + } } if (!deployment.pid) { @@ -188,6 +196,14 @@ export const deploymentRouter = createTRPCRouter({ await checkServicePermissionAndAccess(ctx, serviceId, { deployment: ["cancel"], }); + } else if (deployment.schedule?.serverId) { + const targetServer = await findServerById(deployment.schedule.serverId); + if (targetServer.organizationId !== ctx.session.activeOrganizationId) { + throw new TRPCError({ + code: "UNAUTHORIZED", + message: "You don't have access to this deployment.", + }); + } } const result = await removeDeployment(input.deploymentId); await audit(ctx, { @@ -212,6 +228,14 @@ export const deploymentRouter = createTRPCRouter({ await checkServicePermissionAndAccess(ctx, serviceId, { deployment: ["read"], }); + } else if (deployment.schedule?.serverId) { + const targetServer = await findServerById(deployment.schedule.serverId); + if (targetServer.organizationId !== ctx.session.activeOrganizationId) { + throw new TRPCError({ + code: "UNAUTHORIZED", + message: "You don't have access to this deployment.", + }); + } } if (!deployment.logPath) {