fix: flowise-146

packages/server/src/controllers/chat-messages/index.ts

@@ -166,7 +166,7 @@ const removeAllChatMessages = async (req: Request, res: Response, next: NextFunc
             )
         }
         const chatflowid = req.params.id
-        const chatflow = await chatflowsService.getChatflowById(req.params.id, workspaceId)
+        const chatflow = await chatflowsService.getChatflowByIdForWorkspace(req.params.id, workspaceId)
         if (!chatflow) {
             return res.status(404).send('Chatflow not found')
         }

packages/server/src/controllers/chatflows/index.ts

@@ -268,7 +268,14 @@ const checkIfChatflowHasChanged = async (req: Request, res: Response, next: Next
                 `Error: chatflowsController.checkIfChatflowHasChanged - lastUpdatedDateTime not provided!`
             )
         }
-        const apiResponse = await chatflowsService.checkIfChatflowHasChanged(req.params.id, req.params.lastUpdatedDateTime)
+        const workspaceId = req.user?.activeWorkspaceId
+        if (!workspaceId) {
+            throw new InternalFlowiseError(
+                StatusCodes.NOT_FOUND,
+                'Error: chatflowsController.checkIfChatflowHasChanged - active workspace ID not found!'
+            )
+        }
+        const apiResponse = await chatflowsService.checkIfChatflowHasChanged(req.params.id, req.params.lastUpdatedDateTime, workspaceId)
         return res.json(apiResponse)
     } catch (error) {
         next(error)

packages/server/src/controllers/documentstore/index.ts

@@ -429,6 +429,17 @@ const previewFileChunks = async (req: Request, res: Response, next: NextFunction
         }
         const subscriptionId = req.user?.activeOrganizationSubscriptionId || ''
         const body = req.body
+        if (body.storeId) {
+            const store = await getRunningExpressApp()
+                .AppDataSource.getRepository(DocumentStore)
+                .findOneBy({
+                    id: body.storeId as string,
+                    workspaceId
+                })
+            if (!store) {
+                throw new InternalFlowiseError(StatusCodes.NOT_FOUND, 'Document store not found')
+            }
+        }
         body.preview = true
         const apiResponse = await documentStoreService.previewChunksMiddleware(
             body,

packages/server/src/controllers/internal-predictions/index.ts

@@ -12,7 +12,7 @@ const createInternalPrediction = async (req: Request, res: Response, next: NextF
     try {
         const workspaceId = req.user?.activeWorkspaceId
 
-        const chatflow = await chatflowService.getChatflowById(req.params.id, workspaceId)
+        const chatflow = await chatflowService.getChatflowByIdForWorkspace(req.params.id, workspaceId)
         if (!chatflow) {
             throw new InternalFlowiseError(StatusCodes.NOT_FOUND, `Chatflow ${req.params.id} not found`)
         }

packages/server/src/controllers/leads/index.ts

@@ -1,4 +1,5 @@
 import { Request, Response, NextFunction } from 'express'
+import chatflowsService from '../../services/chatflows'
 import leadsService from '../../services/leads'
 import { StatusCodes } from 'http-status-codes'
 import { InternalFlowiseError } from '../../errors/internalFlowiseError'
@@ -11,7 +12,21 @@ const getAllLeadsForChatflow = async (req: Request, res: Response, next: NextFun
                 `Error: leadsController.getAllLeadsForChatflow - id not provided!`
             )
         }
+        const workspaceId = req.user?.activeWorkspaceId
+        if (!workspaceId) {
+            throw new InternalFlowiseError(
+                StatusCodes.NOT_FOUND,
+                `Error: leadsController.getAllLeadsForChatflow - workspace ${workspaceId} not found!`
+            )
+        }
         const chatflowid = req.params.id
+        const chatflow = await chatflowsService.getChatflowByIdForWorkspace(chatflowid, workspaceId)
+        if (!chatflow) {
+            throw new InternalFlowiseError(
+                StatusCodes.NOT_FOUND,
+                `Error: leadsController.getAllLeadsForChatflow - chatflow ${chatflowid} not found in workspace ${workspaceId}`
+            )
+        }
         const apiResponse = await leadsService.getAllLeads(chatflowid)
         return res.json(apiResponse)
     } catch (error) {

packages/server/src/controllers/openai-assistants-vector-store/index.ts

@@ -18,7 +18,18 @@ const getAssistantVectorStore = async (req: Request, res: Response, next: NextFu
                 `Error: openaiAssistantsVectorStoreController.getAssistantVectorStore - credential not provided!`
             )
         }
-        const apiResponse = await openAIAssistantVectorStoreService.getAssistantVectorStore(req.query.credential as string, req.params.id)
+        const workspaceId = req.user?.activeWorkspaceId
+        if (!workspaceId) {
+            throw new InternalFlowiseError(
+                StatusCodes.NOT_FOUND,
+                `Error: openaiAssistantsVectorStoreController.getAssistantVectorStore - workspace not found!`
+            )
+        }
+        const apiResponse = await openAIAssistantVectorStoreService.getAssistantVectorStore(
+            req.query.credential as string,
+            req.params.id,
+            workspaceId
+        )
         return res.json(apiResponse)
     } catch (error) {
         next(error)
@@ -33,7 +44,14 @@ const listAssistantVectorStore = async (req: Request, res: Response, next: NextF
                 `Error: openaiAssistantsVectorStoreController.listAssistantVectorStore - credential not provided!`
             )
         }
-        const apiResponse = await openAIAssistantVectorStoreService.listAssistantVectorStore(req.query.credential as string)
+        const workspaceId = req.user?.activeWorkspaceId
+        if (!workspaceId) {
+            throw new InternalFlowiseError(
+                StatusCodes.NOT_FOUND,
+                `Error: openaiAssistantsVectorStoreController.listAssistantVectorStore - workspace not found!`
+            )
+        }
+        const apiResponse = await openAIAssistantVectorStoreService.listAssistantVectorStore(req.query.credential as string, workspaceId)
         return res.json(apiResponse)
     } catch (error) {
         next(error)
@@ -54,7 +72,18 @@ const createAssistantVectorStore = async (req: Request, res: Response, next: Nex
                 `Error: openaiAssistantsVectorStoreController.createAssistantVectorStore - credential not provided!`
             )
         }
-        const apiResponse = await openAIAssistantVectorStoreService.createAssistantVectorStore(req.query.credential as string, req.body)
+        const workspaceId = req.user?.activeWorkspaceId
+        if (!workspaceId) {
+            throw new InternalFlowiseError(
+                StatusCodes.NOT_FOUND,
+                `Error: openaiAssistantsVectorStoreController.createAssistantVectorStore - workspace not found!`
+            )
+        }
+        const apiResponse = await openAIAssistantVectorStoreService.createAssistantVectorStore(
+            req.query.credential as string,
+            req.body,
+            workspaceId
+        )
         return res.json(apiResponse)
     } catch (error) {
         next(error)
@@ -81,10 +110,18 @@ const updateAssistantVectorStore = async (req: Request, res: Response, next: Nex
                 `Error: openaiAssistantsVectorStoreController.updateAssistantVectorStore - body not provided!`
             )
         }
+        const workspaceId = req.user?.activeWorkspaceId
+        if (!workspaceId) {
+            throw new InternalFlowiseError(
+                StatusCodes.NOT_FOUND,
+                `Error: openaiAssistantsVectorStoreController.updateAssistantVectorStore - workspace not found!`
+            )
+        }
         const apiResponse = await openAIAssistantVectorStoreService.updateAssistantVectorStore(
             req.query.credential as string,
             req.params.id,
-            req.body
+            req.body,
+            workspaceId
         )
         return res.json(apiResponse)
     } catch (error) {
@@ -106,9 +143,17 @@ const deleteAssistantVectorStore = async (req: Request, res: Response, next: Nex
                 `Error: openaiAssistantsVectorStoreController.updateAssistantVectorStore - credential not provided!`
             )
         }
+        const workspaceId = req.user?.activeWorkspaceId
+        if (!workspaceId) {
+            throw new InternalFlowiseError(
+                StatusCodes.NOT_FOUND,
+                `Error: openaiAssistantsVectorStoreController.deleteAssistantVectorStore - workspace not found!`
+            )
+        }
         const apiResponse = await openAIAssistantVectorStoreService.deleteAssistantVectorStore(
             req.query.credential as string,
-            req.params.id as string
+            req.params.id as string,
+            workspaceId
         )
         return res.json(apiResponse)
     } catch (error) {
@@ -154,10 +199,18 @@ const uploadFilesToAssistantVectorStore = async (req: Request, res: Response, ne
             }
         }
 
+        const workspaceId = req.user?.activeWorkspaceId
+        if (!workspaceId) {
+            throw new InternalFlowiseError(
+                StatusCodes.NOT_FOUND,
+                `Error: openaiAssistantsVectorStoreController.uploadFilesToAssistantVectorStore - workspace not found!`
+            )
+        }
         const apiResponse = await openAIAssistantVectorStoreService.uploadFilesToAssistantVectorStore(
             req.query.credential as string,
             req.params.id as string,
-            uploadFiles
+            uploadFiles,
+            workspaceId
         )
         return res.json(apiResponse)
     } catch (error) {
@@ -186,10 +239,18 @@ const deleteFilesFromAssistantVectorStore = async (req: Request, res: Response,
             )
         }
 
+        const workspaceId = req.user?.activeWorkspaceId
+        if (!workspaceId) {
+            throw new InternalFlowiseError(
+                StatusCodes.NOT_FOUND,
+                `Error: openaiAssistantsVectorStoreController.deleteFilesFromAssistantVectorStore - workspace not found!`
+            )
+        }
         const apiResponse = await openAIAssistantVectorStoreService.deleteFilesFromAssistantVectorStore(
             req.query.credential as string,
             req.params.id as string,
-            req.body.file_ids
+            req.body.file_ids,
+            workspaceId
         )
         return res.json(apiResponse)
     } catch (error) {

packages/server/src/controllers/upsert-history/index.ts

@@ -1,10 +1,28 @@
 import { Request, Response, NextFunction } from 'express'
+import { StatusCodes } from 'http-status-codes'
+import { InternalFlowiseError } from '../../errors/internalFlowiseError'
+import chatflowsService from '../../services/chatflows'
 import upsertHistoryService from '../../services/upsert-history'
 
 const getAllUpsertHistory = async (req: Request, res: Response, next: NextFunction) => {
     try {
-        const sortOrder = req.query?.order as string | undefined
+        const workspaceId = req.user?.activeWorkspaceId
+        if (!workspaceId) {
+            throw new InternalFlowiseError(
+                StatusCodes.NOT_FOUND,
+                `Error: upsertHistoryController.getAllUpsertHistory - workspace ${workspaceId} not found!`
+            )
+        }
         const chatflowid = req.params?.id as string | undefined
+        if (!chatflowid) {
+            throw new InternalFlowiseError(
+                StatusCodes.BAD_REQUEST,
+                'Error: upsertHistoryController.getAllUpsertHistory - chatflow id is required!'
+            )
+        }
+        await chatflowsService.getChatflowById(chatflowid, workspaceId)
+
+        const sortOrder = req.query?.order as string | undefined
         const startDate = req.query?.startDate as string | undefined
         const endDate = req.query?.endDate as string | undefined
         const apiResponse = await upsertHistoryService.getAllUpsertHistory(sortOrder, chatflowid, startDate, endDate)
@@ -16,8 +34,15 @@ const getAllUpsertHistory = async (req: Request, res: Response, next: NextFuncti
 
 const patchDeleteUpsertHistory = async (req: Request, res: Response, next: NextFunction) => {
     try {
+        const workspaceId = req.user?.activeWorkspaceId
+        if (!workspaceId) {
+            throw new InternalFlowiseError(
+                StatusCodes.NOT_FOUND,
+                `Error: upsertHistoryController.patchDeleteUpsertHistory - workspace ${workspaceId} not found!`
+            )
+        }
         const ids = req.body.ids ?? []
-        const apiResponse = await upsertHistoryService.patchDeleteUpsertHistory(ids)
+        const apiResponse = await upsertHistoryService.patchDeleteUpsertHistory(ids, workspaceId)
         return res.json(apiResponse)
     } catch (error) {
         next(error)

packages/server/src/enterprise/controllers/login-method.controller.ts

@@ -12,6 +12,7 @@ import AzureSSO from '../sso/AzureSSO'
 import GithubSSO from '../sso/GithubSSO'
 import GoogleSSO from '../sso/GoogleSSO'
 import { decrypt } from '../utils/encryption.util'
+import { assertQueryOrganizationMatchesActiveOrg, getLoggedInUser } from '../utils/tenantRequestGuards'
 
 export class LoginMethodController {
     constructor() {
@@ -37,6 +38,10 @@ export class LoginMethodController {
     public async create(req: Request, res: Response, next: NextFunction) {
         try {
             this.assertEnterprisePlatform()
+
+            const user = getLoggedInUser(req)
+            assertQueryOrganizationMatchesActiveOrg(user, req.body.organizationId)
+
             const loginMethodService = new LoginMethodService()
             const loginMethod = await loginMethodService.createLoginMethod(req.body)
             return res.status(StatusCodes.CREATED).json(loginMethod)
@@ -86,10 +91,7 @@ export class LoginMethodController {
         let queryRunner
         try {
             this.assertEnterprisePlatform()
-            const user = (req as any).user
-            if (!user?.activeOrganizationId) {
-                throw new InternalFlowiseError(StatusCodes.FORBIDDEN, GeneralErrorMessage.FORBIDDEN)
-            }
+            const user = getLoggedInUser(req)
             queryRunner = getRunningExpressApp().AppDataSource.createQueryRunner()
             await queryRunner.connect()
             const query = req.query as Partial<LoginMethod>
@@ -135,6 +137,10 @@ export class LoginMethodController {
     public async update(req: Request, res: Response, next: NextFunction) {
         try {
             this.assertEnterprisePlatform()
+
+            const user = getLoggedInUser(req)
+            assertQueryOrganizationMatchesActiveOrg(user, req.body.organizationId)
+
             const loginMethodService = new LoginMethodService()
             const loginMethod = await loginMethodService.createOrUpdateConfig(req.body)
             if (loginMethod?.status === 'OK' && loginMethod?.organizationId) {

packages/server/src/enterprise/controllers/organization-user.controller.ts

@@ -17,6 +17,7 @@ import { WorkspaceUser } from '../database/entities/workspace-user.entity'
 import { OrganizationUserService } from '../services/organization-user.service'
 import { RoleService } from '../services/role.service'
 import { WorkspaceService } from '../services/workspace.service'
+import { assertQueryOrganizationMatchesActiveOrg, getLoggedInUser, userMayManageOrgUsers } from '../utils/tenantRequestGuards'
 
 export class OrganizationUserController {
     public async create(req: Request, res: Response, next: NextFunction) {
@@ -35,11 +36,14 @@ export class OrganizationUserController {
     public async read(req: Request, res: Response, next: NextFunction) {
         let queryRunner
         try {
+            const user = getLoggedInUser(req)
             queryRunner = getRunningExpressApp().AppDataSource.createQueryRunner()
             await queryRunner.connect()
             const query = req.query as OrganizationUserQuery
             const organizationUserservice = new OrganizationUserService()
 
+            assertQueryOrganizationMatchesActiveOrg(user, query.organizationId)
+
             let organizationUser:
                 | {
                       organization: Organization
@@ -58,15 +62,32 @@ export class OrganizationUserController {
                     queryRunner
                 )
             } else if (query.organizationId && query.roleId) {
+                if (!userMayManageOrgUsers(user)) {
+                    throw new InternalFlowiseError(StatusCodes.FORBIDDEN, GeneralErrorMessage.FORBIDDEN)
+                }
                 organizationUser = await organizationUserservice.readOrganizationUserByOrganizationIdRoleId(
                     query.organizationId,
                     query.roleId,
                     queryRunner
                 )
             } else if (query.organizationId) {
+                if (!userMayManageOrgUsers(user)) {
+                    throw new InternalFlowiseError(StatusCodes.FORBIDDEN, GeneralErrorMessage.FORBIDDEN)
+                }
                 organizationUser = await organizationUserservice.readOrganizationUserByOrganizationId(query.organizationId, queryRunner)
             } else if (query.userId) {
-                organizationUser = await organizationUserservice.readOrganizationUserByUserId(query.userId, queryRunner)
+                if (query.userId !== user.id && !userMayManageOrgUsers(user)) {
+                    throw new InternalFlowiseError(StatusCodes.FORBIDDEN, GeneralErrorMessage.FORBIDDEN)
+                }
+                if (query.userId === user.id) {
+                    organizationUser = await organizationUserservice.readOrganizationUserByUserId(query.userId, queryRunner)
+                } else {
+                    organizationUser = await organizationUserservice.readOrganizationUserByOrganizationIdUserId(
+                        user.activeOrganizationId,
+                        query.userId,
+                        queryRunner
+                    )
+                }
             } else {
                 throw new InternalFlowiseError(StatusCodes.BAD_REQUEST, GeneralErrorMessage.UNHANDLED_EDGE_CASE)
             }