fix(git-provider): honor sharedWithOrganization in application/compose detail views#4320
Open
RezaRahemtola wants to merge 1 commit intoDokploy:canaryfrom
Open
Conversation
…e detail views The `application.one` and `compose.one` queries were checking `gitProvider.userId !== ctx.session.userId` to compute `hasGitProviderAccess`, ignoring the `sharedWithOrganization` flag and org owner/admin role. As a result, providers shared with the organization (or accessible via Enterprise per-user assignment) still rendered the "Repository connection through unauthorized provider" banner on the detail pages. Replace the check with `getAccessibleGitProviderIds(ctx.session)`, which already drives the listing endpoints (`git-provider.getAll`, `github.githubProviders`, `gitlab.gitlabProviders`, `bitbucket.bitbucketProviders`, `gitea.giteaProviders`). This brings the per-service access check in line with the rest of the codebase and covers all four access paths: creator, sharedWithOrganization, owner/admin role, and per-user assignment. The previous try/catch around `findGitProviderById` is no longer needed: a missing/orphaned provider simply isn't in the returned set, yielding the same "no access" UI without an exception.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The application/compose detail pages still display "Repository connection through unauthorized provider" for git providers shared with the organization (or accessible via owner/admin role / Enterprise per-user assignment), even though the listing endpoints correctly grant access.
Root cause:
application.oneandcompose.onecomputehasGitProviderAccesswith a hand-rolled check (gitProvider.userId !== ctx.session.userId) that pre-dates the sharing feature added in #4135. The other five call sites (git-provider.getAll,github.githubProviders,gitlab.gitlabProviders,bitbucket.bitbucketProviders,gitea.giteaProviders) all usegetAccessibleGitProviderIds(ctx.session), which returns the full set of accessible provider ids (creator +sharedWithOrganization+ owner/admin + per-user assignment).This PR replaces the
userIdcheck in bothapplication.oneandcompose.onewithgetAccessibleGitProviderIds, bringing the detail-view access check in line with every other call site.The previous
try/catcharoundfindGitProviderByIdis no longer needed: a missing/orphaned provider simply isn't in the returned set, producing the same "no access" UI without an exception.Reproduction
Test plan
Checklist
canary.Greptile Summary
This PR fixes a bug where
application.oneandcompose.oneused a hand-rolledgitProvider.userId !== ctx.session.userIdcheck that predated the organization-sharing feature, causing shared/admin-accessible git providers to be incorrectly flagged as unauthorized. Both endpoints now callgetAccessibleGitProviderIds(ctx.session), aligning them with the five other call sites that already use this helper.Confidence Score: 5/5
Safe to merge — the fix is a targeted, correct replacement of a stale access check with the existing shared helper already used by all other call sites.
The change is minimal (two identical hunks), uses a well-tested existing function, correctly handles all access scenarios (owner/admin, sharedWithOrganization, per-user assignment, and missing providers), and introduces no new code paths. No P0 or P1 issues found.
No files require special attention.
Reviews (1): Last reviewed commit: "fix(git-provider): honor sharedWithOrgan..." | Re-trigger Greptile