Dokploy/dokploy
1
0
Fork 0
mirror of https://github.com/Dokploy/dokploy.git synced 2026-07-06 06:25:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(tags): enhance tag management with permission checks

Browse Source 
- Integrated user permissions for tag creation, updating, and deletion in the TagManager component.
- Updated API routes to enforce permission checks for tag operations.
- Added new permissions for managing tags in the roles configuration.
- Improved error handling for unauthorized access in tag-related operations.
This commit is contained in:
Mauricio Siu
2026-03-19 01:27:54 -06:00
parent aca1c6f621
commit fff91157c4
6 changed files with 127 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
apps/dokploy/server/api/routers/settings.ts
View File

@@ -656,6 +656,18 @@ export const settingsRouter = createTRPCRouter({
"github",
"gitlab",
"gitea",
"tag",
"patch",
"server",
"volumeBackups",
"environment",
"auditLog",
"customRole",
"whitelabeling",
"sso",
"licenseKey",
"organization",
"previewDeployment",
],
});

112
apps/dokploy/server/api/routers/tag.ts
View File

@@ -1,3 +1,4 @@
import { findMemberByUserId } from "@dokploy/server/services/permission";
import { TRPCError } from "@trpc/server";
import { and, eq } from "drizzle-orm";
import { z } from "zod";
@@ -11,10 +12,10 @@ import {
projectTags,
tags,
} from "@/server/db/schema";
import { createTRPCRouter, protectedProcedure } from "../trpc";
import { createTRPCRouter, protectedProcedure, withPermission } from "../trpc";
export const tagRouter = createTRPCRouter({
create: protectedProcedure
create: withPermission("tag", "create")
.input(apiCreateTag)
.mutation(async ({ input, ctx }) => {
try {
@@ -46,7 +47,7 @@ export const tagRouter = createTRPCRouter({
}
}),
all: protectedProcedure.query(async ({ ctx }) => {
all: withPermission("tag", "read").query(async ({ ctx }) => {
try {
const organizationTags = await db.query.tags.findMany({
where: eq(tags.organizationId, ctx.session.activeOrganizationId),
@@ -63,36 +64,38 @@ export const tagRouter = createTRPCRouter({
}
}),
one: protectedProcedure.input(apiFindOneTag).query(async ({ input, ctx }) => {
try {
const tag = await db.query.tags.findFirst({
where: and(
eq(tags.tagId, input.tagId),
eq(tags.organizationId, ctx.session.activeOrganizationId),
),
});
one: withPermission("tag", "read")
.input(apiFindOneTag)
.query(async ({ input, ctx }) => {
try {
const tag = await db.query.tags.findFirst({
where: and(
eq(tags.tagId, input.tagId),
eq(tags.organizationId, ctx.session.activeOrganizationId),
),
});
if (!tag) {
if (!tag) {
throw new TRPCError({
code: "NOT_FOUND",
message: "Tag not found",
});
}
return tag;
} catch (error) {
if (error instanceof TRPCError) {
throw error;
}
throw new TRPCError({
code: "NOT_FOUND",
message: "Tag not found",
code: "INTERNAL_SERVER_ERROR",
message: `Error fetching tag: ${error instanceof Error ? error.message : error}`,
cause: error,
});
}
}),
return tag;
} catch (error) {
if (error instanceof TRPCError) {
throw error;
}
throw new TRPCError({
code: "INTERNAL_SERVER_ERROR",
message: `Error fetching tag: ${error instanceof Error ? error.message : error}`,
cause: error,
});
}
}),
update: protectedProcedure
update: withPermission("tag", "update")
.input(apiUpdateTag)
.mutation(async ({ input, ctx }) => {
try {
@@ -142,7 +145,7 @@ export const tagRouter = createTRPCRouter({
}
}),
remove: protectedProcedure
remove: withPermission("tag", "delete")
.input(apiRemoveTag)
.mutation(async ({ input, ctx }) => {
try {
@@ -186,6 +189,11 @@ export const tagRouter = createTRPCRouter({
)
.mutation(async ({ input, ctx }) => {
try {
const memberRecord = await findMemberByUserId(
ctx.user.id,
ctx.session.activeOrganizationId,
);
// Verify the project belongs to the user's organization
const project = await db.query.projects.findFirst({
where: and(
@@ -202,6 +210,18 @@ export const tagRouter = createTRPCRouter({
});
}
// Verify the member has access to the project
if (
memberRecord.role !== "owner" &&
memberRecord.role !== "admin" &&
!memberRecord.accessedProjects.includes(input.projectId)
) {
throw new TRPCError({
code: "UNAUTHORIZED",
message: "You don't have access to this project",
});
}
// Verify the tag belongs to the user's organization
const tag = await db.query.tags.findFirst({
where: and(
@@ -257,6 +277,11 @@ export const tagRouter = createTRPCRouter({
)
.mutation(async ({ input, ctx }) => {
try {
const memberRecord = await findMemberByUserId(
ctx.user.id,
ctx.session.activeOrganizationId,
);
// Verify the project belongs to the user's organization
const project = await db.query.projects.findFirst({
where: and(
@@ -273,6 +298,18 @@ export const tagRouter = createTRPCRouter({
});
}
// Verify the member has access to the project
if (
memberRecord.role !== "owner" &&
memberRecord.role !== "admin" &&
!memberRecord.accessedProjects.includes(input.projectId)
) {
throw new TRPCError({
code: "UNAUTHORIZED",
message: "You don't have access to this project",
});
}
// Verify the tag belongs to the user's organization
const tag = await db.query.tags.findFirst({
where: and(
@@ -320,6 +357,11 @@ export const tagRouter = createTRPCRouter({
)
.mutation(async ({ input, ctx }) => {
try {
const memberRecord = await findMemberByUserId(
ctx.user.id,
ctx.session.activeOrganizationId,
);
// Verify the project belongs to the user's organization
const project = await db.query.projects.findFirst({
where: and(
@@ -336,6 +378,18 @@ export const tagRouter = createTRPCRouter({
});
}
// Verify the member has access to the project
if (
memberRecord.role !== "owner" &&
memberRecord.role !== "admin" &&
!memberRecord.accessedProjects.includes(input.projectId)
) {
throw new TRPCError({
code: "UNAUTHORIZED",
message: "You don't have access to this project",
});
}
// Verify all tags belong to the user's organization
if (input.tagIds.length > 0) {
const tagCount = await db.query.tags.findMany({