mirror of
https://github.com/SigNoz/signoz.git
synced 2026-08-06 05:00:42 +01:00
42de840534
* fix(rules): scope alert rule store operations by org The rule store predicates filtered on the rule id only, so on multi-org deployments (Cloud/EE/multi-org self-hosted, where orgs share the instance via the noop sharder) an authenticated user could read, edit or delete another org's alert rules by supplying the target rule UUID. ViewAccess/EditAccess only check the caller's own-org role, never the resource's org, so nothing enforced tenant isolation on the rule itself. Enforce org scoping at the store layer, which is the durable fix: - GetStoredRule and DeleteRule now take the caller's orgID and add `org_id = ?` to their predicates. - EditRule adds `org_id = ?` (from the model, which is now always sourced from an org-scoped read). - The manager passes claims.OrgID on every by-id path; GetRule now derives the org from claims (it previously fetched by id alone). Cross-org ids now resolve to NotFound instead of leaking or mutating another org's rule. Single-org OSS instances are unaffected. CWE-639 (authorization bypass through user-controlled key). * refactor(rules): derive claims org id with valuer.MustNewUUID Claims are pre-validated by the auth middleware, so the NewUUID error branch is dead code. Follow the handler convention (docs/contributing/ go/handler.md) and use the Must constructor on the by-id rule paths.