Skip to content

fix(security): scope document actions to organization #1114

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
seonghobae wants to merge 5 commits into from
Closed

fix(security): scope document actions to organization #1114

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d4979f7
⚡ Bolt: Optimize threading ID flattening with set comprehension
seonghobae Jul 21, 2026
0f7302d
🛡️ Sentinel: High Fix document retrieval multi-tenant isolation
seonghobae Jul 21, 2026
f004ba0
test(security): cover document organization scope
seonghobae Jul 22, 2026
09d97c3
fix(security): upgrade sharp past GHSA-f88m-g3jw-g9cj
seonghobae Jul 22, 2026
a10c5f8
fix: keep sharp override single-sourced
seonghobae Jul 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions backend/api/data.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2488,10 +2488,16 @@ async def _get_workspace_document(
auth_context: AuthContext,
document_id: str,
) -> Document:
organization_filter = (
Document.organization_id == auth_context.organization_id
if auth_context.organization_id is not None
else Document.organization_id.is_(None)
)
Comment on lines +2491 to +2495
Comment on lines +2491 to +2495
result = await db.execute(
select(Document).where(
Document.document_id == document_id,
Document.workspace_id == auth_context.workspace_id,
organization_filter,
)
Comment on lines +2491 to 2501
)
document = result.scalar_one_or_none()
Expand Down
29 changes: 28 additions & 1 deletion backend/tests/test_data_api.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,11 +101,27 @@ async def execute(self, query):
),
None,
)
organization_ids = [
value
for key, value in params.items()
if key.startswith("organization_id")
]
organization_is_null = (
"workspace_documents.organization_id is null" in rendered_query_lower
)
rows = [
document
for document in self.documents
if (document_id is None or document.document_id == document_id)
and (workspace_id is None or document.workspace_id == workspace_id)
and (
(
organization_ids
and document.organization_id == organization_ids[0]
)
or (organization_is_null and document.organization_id is None)
or (not organization_ids and not organization_is_null)
)
]
Comment on lines +104 to 125
if "order by" in rendered_query_lower:
return MockResult(rows)
Expand Down Expand Up @@ -2484,6 +2500,7 @@ def test_data_quality_surface_includes_workspace_document_assets(mock_db):
Document(
document_id="doc_owned",
workspace_id="workspace-org-acme",
organization_id="org-acme",
document_name="<b>roadmap.md</b>",
document_type="text/markdown",
document_content="# Roadmap",
Expand All @@ -2493,6 +2510,7 @@ def test_data_quality_surface_includes_workspace_document_assets(mock_db):
Document(
document_id="doc_rival",
workspace_id="workspace-rival",
organization_id="org-rival",
document_name="rival.md",
document_type="text/markdown",
document_content="rival",
Expand Down Expand Up @@ -2586,6 +2604,7 @@ def test_data_document_actions_are_workspace_scoped_and_intent_only(mock_db):
document = Document(
document_id="doc_owned",
workspace_id="workspace-org-acme",
organization_id="org-acme",
document_name="source.hwp",
document_type="application/x-hwp",
document_content="opaque hwp extraction placeholder",
Expand All @@ -2594,7 +2613,8 @@ def test_data_document_actions_are_workspace_scoped_and_intent_only(mock_db):
)
rival_document = Document(
document_id="doc_rival",
workspace_id="workspace-rival",
workspace_id="workspace-org-acme",
organization_id="org-rival",
document_name="rival.md",
document_type="text/markdown",
document_content="rival",
Expand Down Expand Up @@ -2638,6 +2658,7 @@ def test_data_document_actions_are_workspace_scoped_and_intent_only(mock_db):

assert rival_response.status_code == 404
assert "doc_rival" not in rival_response.text
assert rival_document.document_status == "uploaded"


def test_data_document_webdav_materialization_executes_source_backed_write(
Expand All @@ -2648,6 +2669,7 @@ def test_data_document_webdav_materialization_executes_source_backed_write(
Document(
document_id="doc_owned",
workspace_id="workspace-org-acme",
organization_id="org-acme",
document_name="../<b>roadmap.md</b>",
document_type="text/markdown",
document_content="# Roadmap\nPhase 10",
Expand Down Expand Up @@ -2743,6 +2765,7 @@ def test_data_document_webdav_materialization_rejects_empty_document(mock_db):
Document(
document_id="doc_empty",
workspace_id="workspace-org-acme",
organization_id="org-acme",
document_name="empty.md",
document_type="text/markdown",
document_content=" ",
Expand Down Expand Up @@ -2777,6 +2800,7 @@ def test_data_document_webdav_materialization_rejects_pending_pdf(mock_db):
Document(
document_id="doc_pending",
workspace_id="workspace-org-acme",
organization_id="org-acme",
document_name="contract.pdf",
document_type="pdf",
document_content="JVBERi0xLjcK", # base64 %PDF-1.7\n
Expand Down Expand Up @@ -2807,6 +2831,7 @@ def test_data_pdf_dom_recognition_intent_rejects_non_pdf_document(mock_db):
Document(
document_id="doc_text",
workspace_id="workspace-org-acme",
organization_id="org-acme",
document_name="notes.md",
document_type="text/markdown",
document_content="# Notes",
Expand All @@ -2830,6 +2855,7 @@ def test_data_pdf_dom_recognition_intent_rejects_non_pdf_document(mock_db):
Document(
document_id="doc_pdf",
workspace_id="workspace-org-acme",
organization_id="org-acme",
document_name="contract.pdf",
document_type="pdf",
document_content="JVBERi0xLjcK",
Expand All @@ -2855,6 +2881,7 @@ def test_data_pdf_dom_recognition_intent_rejects_invalid_stored_payload(mock_db)
Document(
document_id="doc_invalid_pdf",
workspace_id="workspace-org-acme",
organization_id="org-acme",
document_name="contract.pdf",
document_type="pdf",
document_content=base64.b64encode(b"not a PDF").decode("ascii"),
Expand Down
Loading
Loading