create-ailk 0.4.0 → 0.6.0

package/templates/apps/api/src/middleware/default-tenant.ts

@@ -0,0 +1,136 @@
+/**
+ * Default-tenant guard preHandler — the BASE-build tenant guard (#5677).
+ *
+ * The base-build counterpart to `./tenant.ts`, which is a multi-tenant SLICE
+ * (`// oss: false`) and therefore absent on a build without that module. Same
+ * posture, same decoration, same denials; the only difference is where the
+ * tenant comes from — the seeded default Workspace
+ * (`services/default-tenant.ts#resolveDefaultTenant`) rather than the
+ * session's active workspace, which a single-tenant site does not have.
+ *
+ * `server.ts` picks ONE of the two per build: multi-tenant's guard when the
+ * module is enabled, this one otherwise. They never both run, and this one is
+ * never reachable on a build that has the module — a fallback beneath it, not
+ * a parallel path.
+ *
+ * Default-deny — every branch that is not an explicit grant is a denial:
+ *
+ *   - unauthenticated                                    → 401
+ *   - bearer-authenticated (no cookie session — #3591)   → 403
+ *   - AILK_OPERATOR_EMAIL is unset                       → 403
+ *   - the caller's email is not the pinned one           → 403
+ *   - the deployment is not unambiguously single-tenant  → 403
+ *   - the caller holds no Membership on the default Org  → 403
+ *   - URL workspaceId ≠ the resolved workspace           → 403
+ *     (compared BEFORE any lookup of the target — no tenant enumeration)
+ *
+ * The two `AILK_OPERATOR_EMAIL` branches are this guard's own, and they are
+ * why it calls `resolveDefaultTenantForOperator` rather than
+ * `resolveDefaultTenant`: on this build the review surface and
+ * `isPlatformOperator`'s unfiltered `{kind: "all"}` scope became reachable
+ * together, so an unpinned deployment must seat nobody rather than seat
+ * whoever authenticates first. See that function for the full reasoning. A
+ * deployment that wants the dashboard MUST pin the operator; unset is a
+ * refusal, not a default-open.
+ *
+ * The URL-workspaceId comparison is not redundant on this path even though
+ * `resolveDefaultTenant` only ever yields the one seeded workspace: it is what
+ * makes a request naming a FOREIGN workspaceId a 403 rather than a silently
+ * mis-scoped read, and it is the same comparison `tenant.ts` makes, in the
+ * same place.
+ *
+ * This guard deliberately does NOT read `sessionTenant.activeWorkspaceId`.
+ * `resolveDefaultTenant` grants only while `workspace.count() === 1` and that
+ * sole workspace is the sentinel default, so on any build this path can grant
+ * on there is no second workspace for a stale session binding to point at.
+ *
+ * On grant it decorates `request.tenant` (a `TenantContext`), exactly as
+ * `tenant.ts` does; route handlers pass that to `tenantDb(tenant)` so every
+ * domain query is workspace-scoped. The `declare module` augmentation below is
+ * the ONE copy of that decoration's type — `tenant.ts` no longer carries its
+ * own, because this file ships on every build and the paid slice does not.
+ */
+import type {
+  FastifyPluginCallback,
+  FastifyReply,
+  FastifyRequest,
+} from "fastify";
+
+import {
+  resolveDefaultTenantForOperator,
+  type TenantContext,
+} from "../services/default-tenant.js";
+
+declare module "fastify" {
+  interface FastifyRequest {
+    tenant?: TenantContext;
+  }
+}
+
+const FORBIDDEN = {
+  ok: false,
+  error: { code: "forbidden", message: "Forbidden" },
+} as const;
+
+/**
+ * Resolve + attach the default tenant, or reply 401/403. Registered as a hook
+ * in a tenant route scope (after auth), so no tenant-scoped handler runs
+ * without a granted TenantContext.
+ */
+export async function defaultTenantPreHandler(
+  request: FastifyRequest,
+  reply: FastifyReply,
+): Promise<void> {
+  const userId = request.userId;
+  if (!userId) {
+    reply.code(401).send({
+      ok: false,
+      error: { code: "unauthorized", message: "Authentication required" },
+    });
+    return;
+  }
+
+  // Bearer tokens carry no workspace binding (#3591) — denied here, the same
+  // default-deny `resolveActiveTenant` applies on the multi-tenant path.
+  if (!request.sessionTenant) {
+    reply.code(403).send(FORBIDDEN);
+    return;
+  }
+
+  const tenant = await resolveDefaultTenantForOperator(userId);
+  if (!tenant) {
+    reply.code(403).send(FORBIDDEN);
+    return;
+  }
+
+  // URL-scoped routes: the target workspace MUST be the resolved workspace.
+  // Compared before any target lookup — a foreign (or nonexistent)
+  // workspaceId gets the same 403.
+  const params = request.params as { workspaceId?: string } | undefined;
+  if (params?.workspaceId && params.workspaceId !== tenant.workspaceId) {
+    reply.code(403).send(FORBIDDEN);
+    return;
+  }
+
+  request.tenant = tenant;
+}
+
+/**
+ * Plugin form, mirroring `tenantPreHandlerPlugin`: skip-override so the hook
+ * propagates to sibling route plugins registered in the same scope.
+ */
+export const defaultTenantPreHandlerPlugin: FastifyPluginCallback = (
+  fastify,
+  _opts,
+  done,
+) => {
+  fastify.decorateRequest("tenant", undefined);
+  fastify.addHook("preHandler", defaultTenantPreHandler);
+  done();
+};
+
+(
+  defaultTenantPreHandlerPlugin as FastifyPluginCallback & {
+    [key: symbol]: boolean;
+  }
+)[Symbol.for("skip-override")] = true;

package/templates/apps/api/src/middleware/rate-limit.ts

@@ -187,7 +187,13 @@ export const rateLimitMiddleware: FastifyPluginCallback<RateLimitOptions> = (
         // Evict stale buckets on every 429 to cap memory under abuse.
         evictStaleBuckets(now, windowMs);
 
-        req.log.warn({ ip, path: req.url, count: bucket.count }, RATE_LIMITED);
+        // The path WITHOUT its query string (#5970 security review, finding 1): a
+        // route may carry its credential there (`/v1/requests/:id/confirm?token=…`
+        // does), and a rate-limit warning is a line an attacker can provoke at
+        // will — logging the raw target would let them farm credentials out of
+        // the operator's own log by tripping the limiter.
+        const pathOnly = req.url.split("?")[0] ?? req.url;
+        req.log.warn({ ip, path: pathOnly, count: bucket.count }, RATE_LIMITED);
 
         return reply
           .status(429)