Hare/yoi
1
1
Fork 0
Code Actions Packages Releases Activity

fix: enforce prompt projection workspace scope

Browse Source
This commit is contained in:
Hare
2026-08-19 06:07:24 +09:00
parent fb5f49d2a2
commit fcc7c49ff1
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/worker-runtime/src/http_server.rs
+10
View File
@@ -449,9 +449,19 @@ async fn store_config_bundle(
async fn observe_workspace_prompt_projection( async fn observe_workspace_prompt_projection(
State(state): State<RuntimeHttpState>, State(state): State<RuntimeHttpState>,
auth: Option<Extension<RuntimeAuthContext>>,
body: Result<Json<RuntimeHttpWorkspacePromptProjectionRequest>, JsonRejection>, body: Result<Json<RuntimeHttpWorkspacePromptProjectionRequest>, JsonRejection>,
) -> RestResult<RuntimeHttpWorkspacePromptProjectionResponse> { ) -> RestResult<RuntimeHttpWorkspacePromptProjectionResponse> {
let Json(request) = body.map_err(RuntimeHttpRestError::json_rejection)?; let Json(request) = body.map_err(RuntimeHttpRestError::json_rejection)?;
if let Some(scope) = auth_workspace_scope(&state, auth.as_ref())?
&& request.projection.workspace_id != scope.workspace_id
{
return Err(RuntimeHttpRestError::new(
StatusCode::FORBIDDEN,
"workspace_scope_mismatch",
"Workspace Prompt projection is outside the authenticated Workspace scope",
));
}
let workspace_id = request.projection.workspace_id.clone(); let workspace_id = request.projection.workspace_id.clone();
let config_revision = request.projection.config_revision; let config_revision = request.projection.config_revision;
state state