test: multi-org isolation

app/server/__tests__/isolation.test.ts

@@ -0,0 +1,207 @@
+import { test, describe, expect } from "bun:test";
+import { createApp } from "~/server/app";
+import { createTestSession } from "~/test/helpers/auth";
+import { db } from "~/server/db/db";
+import { repositoriesTable, volumesTable, backupSchedulesTable } from "~/server/db/schema";
+import crypto from "node:crypto";
+import { generateShortId } from "~/server/utils/id";
+
+const app = createApp();
+
+describe("multi-organization isolation", () => {
+	test("should not be able to access repositories from another organization", async () => {
+		const session1 = await createTestSession();
+		const session2 = await createTestSession();
+
+		expect(session1.organizationId).not.toBe(session2.organizationId);
+
+		const repoId = crypto.randomUUID();
+		const shortId = generateShortId();
+		await db.insert(repositoriesTable).values({
+			id: repoId,
+			shortId,
+			name: "Org 1 Repo",
+			type: "local",
+			config: { backend: "local", name: "org1repo", path: "/tmp/repo1" },
+			organizationId: session1.organizationId,
+		});
+
+		const res = await app.request(`/api/v1/repositories/${repoId}`, {
+			headers: {
+				Cookie: `better-auth.session_token=${session2.token}`,
+			},
+		});
+
+		expect(res.status).toBe(404);
+		const body = await res.json();
+		expect(body.message).toBe("Repository not found");
+
+		const resOk = await app.request(`/api/v1/repositories/${repoId}`, {
+			headers: {
+				Cookie: `better-auth.session_token=${session1.token}`,
+			},
+		});
+		expect(resOk.status).toBe(200);
+	});
+
+	test("should not list repositories from another organization", async () => {
+		const session1 = await createTestSession();
+		const session2 = await createTestSession();
+
+		await db.insert(repositoriesTable).values({
+			id: crypto.randomUUID(),
+			shortId: generateShortId(),
+			name: "Org 1 Repo",
+			type: "local",
+			config: { backend: "local", name: "org1repo-list", path: "/tmp/repo1" },
+			organizationId: session1.organizationId,
+		});
+
+		await db.insert(repositoriesTable).values({
+			id: crypto.randomUUID(),
+			shortId: generateShortId(),
+			name: "Org 2 Repo",
+			type: "local",
+			config: { backend: "local", name: "org2repo-list", path: "/tmp/repo2" },
+			organizationId: session2.organizationId,
+		});
+
+		const res1 = await app.request("/api/v1/repositories", {
+			headers: {
+				Cookie: `better-auth.session_token=${session1.token}`,
+			},
+		});
+		const list1 = await res1.json();
+
+		expect(list1.length).toBeGreaterThanOrEqual(1);
+		expect(list1.some((r: any) => r.name === "Org 2 Repo")).toBe(false);
+
+		const res2 = await app.request("/api/v1/repositories", {
+			headers: {
+				Cookie: `better-auth.session_token=${session2.token}`,
+			},
+		});
+		const list2 = await res2.json();
+		expect(list2.some((r: any) => r.name === "Org 1 Repo")).toBe(false);
+		expect(list2.some((r: any) => r.name === "Org 2 Repo")).toBe(true);
+	});
+
+	test("should not be able to access volumes from another organization", async () => {
+		const session1 = await createTestSession();
+		const session2 = await createTestSession();
+
+		const volumeId = Math.floor(Math.random() * 1000000);
+		await db.insert(volumesTable).values({
+			id: volumeId,
+			shortId: generateShortId(),
+			name: "Org 1 Volume",
+			type: "directory",
+			config: { backend: "directory", path: "/tmp/vol1" },
+			organizationId: session1.organizationId,
+			status: "unmounted",
+		});
+
+		const res = await app.request(`/api/v1/volumes/${volumeId}`, {
+			headers: {
+				Cookie: `better-auth.session_token=${session2.token}`,
+			},
+		});
+
+		expect(res.status).toBe(404);
+	});
+
+	test("should not be able to create a backup schedule referencing resources from another organization", async () => {
+		const session1 = await createTestSession();
+		const session2 = await createTestSession();
+
+		const vol1Id = Math.floor(Math.random() * 1000000);
+		await db.insert(volumesTable).values({
+			id: vol1Id,
+			shortId: generateShortId(),
+			name: "Org 1 Volume",
+			type: "directory",
+			config: { backend: "directory", path: "/tmp/vol1" },
+			organizationId: session1.organizationId,
+			status: "unmounted",
+		});
+
+		const repo1Id = crypto.randomUUID();
+		await db.insert(repositoriesTable).values({
+			id: repo1Id,
+			shortId: generateShortId(),
+			name: "Org 1 Repo",
+			type: "local",
+			config: { backend: "local", name: "org1repo", path: "/tmp/repo1" },
+			organizationId: session1.organizationId,
+		});
+
+		const res = await app.request("/api/v1/backups", {
+			method: "POST",
+			headers: {
+				Cookie: `better-auth.session_token=${session2.token}`,
+				"Content-Type": "application/json",
+			},
+			body: JSON.stringify({
+				name: "Malicious Schedule",
+				volumeId: vol1Id,
+				repositoryId: repo1Id,
+				enabled: true,
+				cronExpression: "0 0 * * *",
+			}),
+		});
+
+		expect(res.status).toBe(404);
+	});
+
+	test("should not be able to access backup schedules from another organization", async () => {
+		const session1 = await createTestSession();
+		const session2 = await createTestSession();
+
+		const vol1Id = Math.floor(Math.random() * 1000000);
+		await db.insert(volumesTable).values({
+			id: vol1Id,
+			shortId: generateShortId(),
+			name: "Org 1 Volume",
+			type: "directory",
+			config: { backend: "directory", path: "/tmp/vol1" },
+			organizationId: session1.organizationId,
+			status: "unmounted",
+		});
+		const repo1Id = crypto.randomUUID();
+		await db.insert(repositoriesTable).values({
+			id: repo1Id,
+			shortId: generateShortId(),
+			name: "Org 1 Repo",
+			type: "local",
+			config: { backend: "local", name: "org1repo", path: "/tmp/repo1" },
+			organizationId: session1.organizationId,
+		});
+
+		const [schedule] = await db
+			.insert(backupSchedulesTable)
+			.values({
+				shortId: generateShortId(),
+				name: "Org 1 Schedule",
+				volumeId: vol1Id,
+				repositoryId: repo1Id,
+				cronExpression: "0 0 * * *",
+				organizationId: session1.organizationId,
+			})
+			.returning();
+
+		const res = await app.request(`/api/v1/backups/${schedule.id}`, {
+			headers: {
+				Cookie: `better-auth.session_token=${session2.token}`,
+			},
+		});
+
+		expect(res.status).toBe(404);
+
+		const resOk = await app.request(`/api/v1/backups/${schedule.id}`, {
+			headers: {
+				Cookie: `better-auth.session_token=${session1.token}`,
+			},
+		});
+		expect(resOk.status).toBe(200);
+	});
+});

app/test/helpers/auth.ts

@@ -2,53 +2,36 @@ import { db } from "~/server/db/db";
 import { sessionsTable, usersTable, account, organization, member } from "~/server/db/schema";
 import { hashPassword } from "better-auth/crypto";
 import { createHmac } from "node:crypto";
-import { eq } from "drizzle-orm";
 
 export async function createTestSession() {
-	const [existingUser] = await db.select().from(usersTable);
+	const userId = crypto.randomUUID();
-
+	const user = {
-	if (!existingUser) {
+		username: `testuser-${userId}`,
-		await db.insert(usersTable).values({
+		email: `${userId}@test.com`,
-			username: "testuser",
+		name: "Test User",
-			email: "test@test.com",
+		id: userId,
-			name: "Test User",
+	};
-			id: crypto.randomUUID(),
+	await db.insert(usersTable).values(user);
-		});
-	}
-
-	const [user] = await db.select().from(usersTable);
 
 	const token = crypto.randomUUID().replace(/-/g, "");
 	const sessionId = token;
 	const expiresAt = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000);
 
-	const [existingOrg] = await db.select().from(organization);
+	const orgId = crypto.randomUUID();
+	await db.insert(organization).values({
+		id: orgId,
+		name: `Org ${orgId}`,
+		slug: `test-org-${orgId}`,
+		createdAt: new Date(),
+	});
 
-	let orgId: string;
+	await db.insert(member).values({
-
+		id: crypto.randomUUID(),
-	if (!existingOrg) {
+		userId: user.id,
-		orgId = crypto.randomUUID();
+		organizationId: orgId,
-		await db.insert(organization).values({
+		role: "owner",
-			id: orgId,
+		createdAt: new Date(),
-			name: "Test Org",
+	});
-			slug: "test-org",
-			createdAt: new Date(),
-		});
-	} else {
-		orgId = existingOrg.id;
-	}
-
-	const [existingMember] = await db.select().from(member).where(eq(member.userId, user.id));
-
-	if (!existingMember) {
-		await db.insert(member).values({
-			id: crypto.randomUUID(),
-			userId: user.id,
-			organizationId: orgId,
-			role: "owner",
-			createdAt: new Date(),
-		});
-	}
 
 	await db.insert(sessionsTable).values({
 		id: sessionId,
@@ -67,7 +50,7 @@ export async function createTestSession() {
 		.insert(account)
 		.values({
 			userId: user.id,
-			accountId: "testuser",
+			accountId: user.username,
 			password: await hashPassword("password123"),
 			id: crypto.randomUUID(),
 			providerId: "credentials",