refactor(cloud): validate all the routes to prevent get access from private resource

apps/dokploy/server/api/routers/compose.ts

@@ -83,12 +83,26 @@ export const composeRouter = createTRPCRouter({
 				await checkServiceAccess(ctx.user.authId, input.composeId, "access");
 			}
 
-			return await findComposeById(input.composeId);
+			const compose = await findComposeById(input.composeId);
+			if (compose.project.adminId !== ctx.user.adminId) {
+				throw new TRPCError({
+					code: "UNAUTHORIZED",
+					message: "You are not authorized to access this compose",
+				});
+			}
+			return compose;
 		}),
 
 	update: protectedProcedure
 		.input(apiUpdateCompose)
-		.mutation(async ({ input }) => {
+		.mutation(async ({ input, ctx }) => {
+			const compose = await findComposeById(input.composeId);
+			if (compose.project.adminId !== ctx.user.adminId) {
+				throw new TRPCError({
+					code: "UNAUTHORIZED",
+					message: "You are not authorized to update this compose",
+				});
+			}
 			return updateCompose(input.composeId, input);
 		}),
 	delete: protectedProcedure
@@ -99,6 +113,14 @@ export const composeRouter = createTRPCRouter({
 			}
 			const composeResult = await findComposeById(input.composeId);
 
+			if (composeResult.project.adminId !== ctx.user.adminId) {
+				throw new TRPCError({
+					code: "UNAUTHORIZED",
+					message: "You are not authorized to delete this compose",
+				});
+			}
+			4;
+
 			const result = await db
 				.delete(compose)
 				.where(eq(compose.composeId, input.composeId))
@@ -120,20 +142,41 @@ export const composeRouter = createTRPCRouter({
 		}),
 	cleanQueues: protectedProcedure
 		.input(apiFindCompose)
-		.mutation(async ({ input }) => {
+		.mutation(async ({ input, ctx }) => {
+			const compose = await findComposeById(input.composeId);
+			if (compose.project.adminId !== ctx.user.adminId) {
+				throw new TRPCError({
+					code: "UNAUTHORIZED",
+					message: "You are not authorized to clean this compose",
+				});
+			}
 			await cleanQueuesByCompose(input.composeId);
 		}),
 
 	loadServices: protectedProcedure
 		.input(apiFetchServices)
-		.query(async ({ input }) => {
+		.query(async ({ input, ctx }) => {
+			const compose = await findComposeById(input.composeId);
+			if (compose.project.adminId !== ctx.user.adminId) {
+				throw new TRPCError({
+					code: "UNAUTHORIZED",
+					message: "You are not authorized to load this compose",
+				});
+			}
 			return await loadServices(input.composeId, input.type);
 		}),
 	fetchSourceType: protectedProcedure
 		.input(apiFindCompose)
-		.mutation(async ({ input }) => {
+		.mutation(async ({ input, ctx }) => {
 			try {
 				const compose = await findComposeById(input.composeId);
+
+				if (compose.project.adminId !== ctx.user.adminId) {
+					throw new TRPCError({
+						code: "UNAUTHORIZED",
+						message: "You are not authorized to fetch this compose",
+					});
+				}
 				if (compose.serverId) {
 					await cloneComposeRemote(compose);
 				} else {
@@ -151,13 +194,26 @@ export const composeRouter = createTRPCRouter({
 
 	randomizeCompose: protectedProcedure
 		.input(apiRandomizeCompose)
-		.mutation(async ({ input }) => {
+		.mutation(async ({ input, ctx }) => {
+			const compose = await findComposeById(input.composeId);
+			if (compose.project.adminId !== ctx.user.adminId) {
+				throw new TRPCError({
+					code: "UNAUTHORIZED",
+					message: "You are not authorized to randomize this compose",
+				});
+			}
 			return await randomizeComposeFile(input.composeId, input.suffix);
 		}),
 	getConvertedCompose: protectedProcedure
 		.input(apiFindCompose)
-		.query(async ({ input }) => {
+		.query(async ({ input, ctx }) => {
 			const compose = await findComposeById(input.composeId);
+			if (compose.project.adminId !== ctx.user.adminId) {
+				throw new TRPCError({
+					code: "UNAUTHORIZED",
+					message: "You are not authorized to get this compose",
+				});
+			}
 			const domains = await findDomainsByComposeId(input.composeId);
 			const composeFile = await addDomainToCompose(compose, domains);
 			return dump(composeFile, {
@@ -167,8 +223,15 @@ export const composeRouter = createTRPCRouter({
 
 	deploy: protectedProcedure
 		.input(apiFindCompose)
-		.mutation(async ({ input }) => {
+		.mutation(async ({ input, ctx }) => {
 			const compose = await findComposeById(input.composeId);
+
+			if (compose.project.adminId !== ctx.user.adminId) {
+				throw new TRPCError({
+					code: "UNAUTHORIZED",
+					message: "You are not authorized to deploy this compose",
+				});
+			}
 			const jobData: DeploymentJob = {
 				composeId: input.composeId,
 				titleLog: "Manual deployment",
@@ -188,8 +251,14 @@ export const composeRouter = createTRPCRouter({
 		}),
 	redeploy: protectedProcedure
 		.input(apiFindCompose)
-		.mutation(async ({ input }) => {
+		.mutation(async ({ input, ctx }) => {
 			const compose = await findComposeById(input.composeId);
+			if (compose.project.adminId !== ctx.user.adminId) {
+				throw new TRPCError({
+					code: "UNAUTHORIZED",
+					message: "You are not authorized to redeploy this compose",
+				});
+			}
 			const jobData: DeploymentJob = {
 				composeId: input.composeId,
 				titleLog: "Rebuild deployment",
@@ -207,21 +276,44 @@ export const composeRouter = createTRPCRouter({
 				},
 			);
 		}),
-	stop: protectedProcedure.input(apiFindCompose).mutation(async ({ input }) => {
-		await stopCompose(input.composeId);
+	stop: protectedProcedure
+		.input(apiFindCompose)
+		.mutation(async ({ input, ctx }) => {
+			const compose = await findComposeById(input.composeId);
+			if (compose.project.adminId !== ctx.user.adminId) {
+				throw new TRPCError({
+					code: "UNAUTHORIZED",
+					message: "You are not authorized to stop this compose",
+				});
+			}
+			await stopCompose(input.composeId);
 
-		return true;
-	}),
+			return true;
+		}),
 	getDefaultCommand: protectedProcedure
 		.input(apiFindCompose)
-		.query(async ({ input }) => {
+		.query(async ({ input, ctx }) => {
 			const compose = await findComposeById(input.composeId);
+
+			if (compose.project.adminId !== ctx.user.adminId) {
+				throw new TRPCError({
+					code: "UNAUTHORIZED",
+					message: "You are not authorized to get this compose",
+				});
+			}
 			const command = createCommand(compose);
 			return `docker ${command}`;
 		}),
 	refreshToken: protectedProcedure
 		.input(apiFindCompose)
-		.mutation(async ({ input }) => {
+		.mutation(async ({ input, ctx }) => {
+			const compose = await findComposeById(input.composeId);
+			if (compose.project.adminId !== ctx.user.adminId) {
+				throw new TRPCError({
+					code: "UNAUTHORIZED",
+					message: "You are not authorized to refresh this compose",
+				});
+			}
 			await updateCompose(input.composeId, {
 				refreshToken: nanoid(),
 			});
@@ -233,6 +325,7 @@ export const composeRouter = createTRPCRouter({
 			if (ctx.user.rol === "user") {
 				await checkServiceAccess(ctx.user.authId, input.projectId, "create");
 			}
+
 			const composeFile = await readTemplateComposeFile(input.id);
 
 			const generate = await loadTemplateModule(input.id as TemplatesKeys);