calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-08-01 18:20:35 +02:00
Code Issues Packages Projects Releases Wiki Activity

add targets and refactor endpoints

Browse Source
This commit is contained in:
miloschwartz
2026-07-31 17:36:04 -04:00
parent 573747c237
commit 28430dde74
31 changed files with 741 additions and 490 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/middlewares/integration/verifyApiKeyAiModelAccess.ts
+4 -23
View File
@@ -14,9 +14,6 @@ export async function verifyApiKeyAiModelAccess(
const apiKey = req.apiKey;
const modelIdRaw = getFirstString(req.params.modelId);
const modelId = Number.parseInt(modelIdRaw ?? "", 10);
const providerIdRaw = getFirstString(req.params.providerId);
const providerId = Number.parseInt(providerIdRaw ?? "", 10);
const orgId = getFirstString(req.params.orgId);
if (!apiKey) {
return next(
@@ -24,18 +21,6 @@ export async function verifyApiKeyAiModelAccess(
);
}
if (!orgId) {
return next(
createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
);
}
if (Number.isNaN(providerId)) {
return next(
createHttpError(HttpCode.BAD_REQUEST, "Invalid provider ID")
);
}
if (Number.isNaN(modelId)) {
return next(
createHttpError(HttpCode.BAD_REQUEST, "Invalid model ID")
@@ -52,13 +37,7 @@ export async function verifyApiKeyAiModelAccess(
aiProviders,
eq(aiModels.providerId, aiProviders.providerId)
)
.where(
and(
eq(aiModels.modelId, modelId),
eq(aiModels.providerId, providerId),
eq(aiProviders.orgId, orgId)
)
)
.where(eq(aiModels.modelId, modelId))
.limit(1);
if (!row) {
@@ -76,7 +55,9 @@ export async function verifyApiKeyAiModelAccess(
return next();
}
if (!req.apiKeyOrg) {
const orgId = row.provider.orgId;
if (!req.apiKeyOrg || req.apiKeyOrg.orgId !== orgId) {
const apiKeyOrgRes = await db
.select()
.from(apiKeyOrg)
server/middlewares/integration/verifyApiKeyAiProviderAccess.ts
+9 -39
View File
@@ -14,7 +14,6 @@ export async function verifyApiKeyAiProviderAccess(
const apiKey = req.apiKey;
const providerIdRaw = getFirstString(req.params.providerId);
const providerId = Number.parseInt(providerIdRaw ?? "", 10);
const orgId = getFirstString(req.params.orgId);
if (!apiKey) {
return next(
@@ -22,52 +21,16 @@ export async function verifyApiKeyAiProviderAccess(
);
}
if (!orgId) {
return next(
createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
);
}
if (Number.isNaN(providerId)) {
return next(
createHttpError(HttpCode.BAD_REQUEST, "Invalid provider ID")
);
}
if (apiKey.isRoot) {
const [provider] = await db
.select()
.from(aiProviders)
.where(
and(
eq(aiProviders.providerId, providerId),
eq(aiProviders.orgId, orgId)
)
)
.limit(1);
if (!provider) {
return next(
createHttpError(
HttpCode.NOT_FOUND,
`AI provider with ID ${providerId} not found`
)
);
}
req.aiProvider = provider;
return next();
}
const [provider] = await db
.select()
.from(aiProviders)
.where(
and(
eq(aiProviders.providerId, providerId),
eq(aiProviders.orgId, orgId)
)
)
.where(eq(aiProviders.providerId, providerId))
.limit(1);
if (!provider) {
@@ -79,7 +42,14 @@ export async function verifyApiKeyAiProviderAccess(
);
}
if (!req.apiKeyOrg) {
if (apiKey.isRoot) {
req.aiProvider = provider;
return next();
}
const orgId = provider.orgId;
if (!req.apiKeyOrg || req.apiKeyOrg.orgId !== orgId) {
const apiKeyOrgRes = await db
.select()
.from(apiKeyOrg)
server/middlewares/integration/verifyApiKeyTargetAccess.ts
+51 -29
View File
@@ -1,6 +1,6 @@
import { Request, Response, NextFunction } from "express";
import { db } from "@server/db";
import { resources, targets, apiKeyOrg } from "@server/db";
import { aiProviders, resources, targets, apiKeyOrg } from "@server/db";
import { and, eq } from "drizzle-orm";
import createHttpError from "http-errors";
import HttpCode from "@server/types/HttpCode";
@@ -43,43 +43,65 @@ export async function verifyApiKeyTargetAccess(
);
}
const resourceId = target.resourceId;
if (!resourceId) {
const { resourceId, providerId } = target;
if ((!resourceId && !providerId) || (resourceId && providerId)) {
return next(
createHttpError(
HttpCode.INTERNAL_SERVER_ERROR,
`Target with ID ${targetId} does not have a resource ID`
)
);
}
const [resource] = await db
.select()
.from(resources)
.where(eq(resources.resourceId, resourceId))
.limit(1);
if (!resource) {
return next(
createHttpError(
HttpCode.NOT_FOUND,
`Resource with ID ${resourceId} not found`
`Target with ID ${targetId} has invalid ownership`
)
);
}
if (apiKey.isRoot) {
// Root keys can access any key in any org
// Root keys can access any target
return next();
}
if (!resource.orgId) {
return next(
createHttpError(
HttpCode.INTERNAL_SERVER_ERROR,
`Resource with ID ${resourceId} does not have an organization ID`
)
);
let orgId: string;
if (resourceId) {
const [resource] = await db
.select()
.from(resources)
.where(eq(resources.resourceId, resourceId))
.limit(1);
if (!resource) {
return next(
createHttpError(
HttpCode.NOT_FOUND,
`Resource with ID ${resourceId} not found`
)
);
}
if (!resource.orgId) {
return next(
createHttpError(
HttpCode.INTERNAL_SERVER_ERROR,
`Resource with ID ${resourceId} does not have an organization ID`
)
);
}
orgId = resource.orgId;
} else {
const [provider] = await db
.select()
.from(aiProviders)
.where(eq(aiProviders.providerId, providerId!))
.limit(1);
if (!provider) {
return next(
createHttpError(
HttpCode.NOT_FOUND,
`AI provider with ID ${providerId} not found`
)
);
}
orgId = provider.orgId;
}
if (!req.apiKeyOrg) {
@@ -89,7 +111,7 @@ export async function verifyApiKeyTargetAccess(
.where(
and(
eq(apiKeyOrg.apiKeyId, apiKey.apiKeyId),
eq(apiKeyOrg.orgId, resource.orgId)
eq(apiKeyOrg.orgId, orgId)
)
)
.limit(1);
@@ -98,7 +120,7 @@ export async function verifyApiKeyTargetAccess(
}
}
if (!req.apiKeyOrg) {
if (!req.apiKeyOrg || req.apiKeyOrg.orgId !== orgId) {
return next(
createHttpError(
HttpCode.FORBIDDEN,
server/middlewares/verifyAiModelAccess.ts
+5 -23
View File
@@ -16,9 +16,6 @@ export async function verifyAiModelAccess(
const userId = req.user!.userId;
const modelIdRaw = getFirstString(req.params.modelId);
const modelId = Number.parseInt(modelIdRaw ?? "", 10);
const providerIdRaw = getFirstString(req.params.providerId);
const providerId = Number.parseInt(providerIdRaw ?? "", 10);
const orgId = getFirstString(req.params.orgId);
if (!userId) {
return next(
@@ -26,18 +23,6 @@ export async function verifyAiModelAccess(
);
}
if (!orgId) {
return next(
createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
);
}
if (Number.isNaN(providerId)) {
return next(
createHttpError(HttpCode.BAD_REQUEST, "Invalid provider ID")
);
}
if (Number.isNaN(modelId)) {
return next(
createHttpError(HttpCode.BAD_REQUEST, "Invalid model ID")
@@ -54,13 +39,7 @@ export async function verifyAiModelAccess(
aiProviders,
eq(aiModels.providerId, aiProviders.providerId)
)
.where(
and(
eq(aiModels.modelId, modelId),
eq(aiModels.providerId, providerId),
eq(aiProviders.orgId, orgId)
)
)
.where(eq(aiModels.modelId, modelId))
.limit(1);
if (!row) {
@@ -72,7 +51,9 @@ export async function verifyAiModelAccess(
);
}
if (!req.userOrg) {
const orgId = row.provider.orgId;
if (!req.userOrg || req.userOrg.orgId !== orgId) {
const userOrgRole = await db
.select()
.from(userOrgs)
@@ -109,6 +90,7 @@ export async function verifyAiModelAccess(
}
}
req.userOrgId = orgId;
req.userOrgRoleIds = await getUserOrgRoleIds(req.userOrg.userId, orgId);
req.aiProvider = row.provider;
req.aiModel = row.model;
server/middlewares/verifyAiProviderAccess.ts
+5 -14
View File
@@ -16,7 +16,6 @@ export async function verifyAiProviderAccess(
const userId = req.user!.userId;
const providerIdRaw = getFirstString(req.params.providerId);
const providerId = Number.parseInt(providerIdRaw ?? "", 10);
const orgId = getFirstString(req.params.orgId);
if (!userId) {
return next(
@@ -24,12 +23,6 @@ export async function verifyAiProviderAccess(
);
}
if (!orgId) {
return next(
createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
);
}
if (Number.isNaN(providerId)) {
return next(
createHttpError(HttpCode.BAD_REQUEST, "Invalid provider ID")
@@ -39,12 +32,7 @@ export async function verifyAiProviderAccess(
const [provider] = await db
.select()
.from(aiProviders)
.where(
and(
eq(aiProviders.providerId, providerId),
eq(aiProviders.orgId, orgId)
)
)
.where(eq(aiProviders.providerId, providerId))
.limit(1);
if (!provider) {
@@ -56,7 +44,9 @@ export async function verifyAiProviderAccess(
);
}
if (!req.userOrg) {
const orgId = provider.orgId;
if (!req.userOrg || req.userOrg.orgId !== orgId) {
const userOrgRole = await db
.select()
.from(userOrgs)
@@ -93,6 +83,7 @@ export async function verifyAiProviderAccess(
}
}
req.userOrgId = orgId;
req.userOrgRoleIds = await getUserOrgRoleIds(req.userOrg.userId, orgId);
req.aiProvider = provider;
server/middlewares/verifyTargetAccess.ts
+71 -56
View File
@@ -1,6 +1,6 @@
import { Request, Response, NextFunction } from "express";
import { db } from "@server/db";
import { resources, targets, userOrgs } from "@server/db";
import { aiProviders, resources, targets, userOrgs } from "@server/db";
import { and, eq } from "drizzle-orm";
import createHttpError from "http-errors";
import HttpCode from "@server/types/HttpCode";
@@ -25,9 +25,7 @@ export async function verifyTargetAccess(
}
if (isNaN(targetId)) {
return next(
createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
);
return next(createHttpError(HttpCode.BAD_REQUEST, "Invalid target ID"));
}
const target = await db
@@ -45,73 +43,88 @@ export async function verifyTargetAccess(
);
}
const resourceId = target[0].resourceId;
const { resourceId, providerId } = target[0];
if (!resourceId) {
if ((!resourceId && !providerId) || (resourceId && providerId)) {
return next(
createHttpError(
HttpCode.INTERNAL_SERVER_ERROR,
`Target with ID ${targetId} does not have a resource ID`
`Target with ID ${targetId} has invalid ownership`
)
);
}
try {
const resource = await db
.select()
.from(resources)
.where(eq(resources.resourceId, resourceId!))
.limit(1);
let orgId: string;
if (resource.length === 0) {
return next(
createHttpError(
HttpCode.NOT_FOUND,
`Resource with ID ${resourceId} not found`
)
);
}
if (resourceId) {
const [resource] = await db
.select()
.from(resources)
.where(eq(resources.resourceId, resourceId))
.limit(1);
if (!resource[0].orgId) {
return next(
createHttpError(
HttpCode.INTERNAL_SERVER_ERROR,
`resource with ID ${resourceId} does not have an organization ID`
)
);
if (!resource) {
return next(
createHttpError(
HttpCode.NOT_FOUND,
`Resource with ID ${resourceId} not found`
)
);
}
if (!resource.orgId) {
return next(
createHttpError(
HttpCode.INTERNAL_SERVER_ERROR,
`Resource with ID ${resourceId} does not have an organization ID`
)
);
}
orgId = resource.orgId;
} else {
const [provider] = await db
.select()
.from(aiProviders)
.where(eq(aiProviders.providerId, providerId!))
.limit(1);
if (!provider) {
return next(
createHttpError(
HttpCode.NOT_FOUND,
`AI provider with ID ${providerId} not found`
)
);
}
orgId = provider.orgId;
}
if (!req.userOrg) {
const res = await db
const userOrgResult = await db
.select()
.from(userOrgs)
.where(
and(
eq(userOrgs.userId, userId),
eq(userOrgs.orgId, resource[0].orgId)
)
and(eq(userOrgs.userId, userId), eq(userOrgs.orgId, orgId))
);
req.userOrg = res[0];
req.userOrg = userOrgResult[0];
}
if (!req.userOrg) {
next(
if (!req.userOrg || req.userOrg.orgId !== orgId) {
return next(
createHttpError(
HttpCode.FORBIDDEN,
"User does not have access to this organization"
)
);
} else {
req.userOrgRoleIds = await getUserOrgRoleIds(
req.userOrg.userId,
resource[0].orgId!
);
req.userOrgId = resource[0].orgId!;
}
const orgId = req.userOrg.orgId;
req.userOrgRoleIds = await getUserOrgRoleIds(req.userOrg.userId, orgId);
req.userOrgId = orgId;
if (req.orgPolicyAllowed === undefined && orgId) {
if (req.orgPolicyAllowed === undefined) {
const policyCheck = await checkOrgAccessPolicy({
orgId,
userId,
@@ -128,22 +141,24 @@ export async function verifyTargetAccess(
}
}
const resourceAllowed = await canUserAccessResource({
userId,
resourceId,
roleIds: req.userOrgRoleIds ?? []
});
if (resourceId) {
const resourceAllowed = await canUserAccessResource({
userId,
resourceId,
roleIds: req.userOrgRoleIds ?? []
});
if (!resourceAllowed) {
return next(
createHttpError(
HttpCode.FORBIDDEN,
"User does not have access to this resource"
)
);
if (!resourceAllowed) {
return next(
createHttpError(
HttpCode.FORBIDDEN,
"User does not have access to this resource"
)
);
}
}
next();
return next();
} catch (e) {
return next(
createHttpError(