fix: issues found in security audit (#1668)

packages/api/src/router/board.ts

@@ -575,11 +575,14 @@ export const boardRouter = createTRPCRouter({
         );
       });
     }),
-  importOldmarrConfig: protectedProcedure.input(importJsonFileSchema).mutation(async ({ input, ctx }) => {
-    const content = await input.file.text();
-    const oldmarr = oldmarrConfigSchema.parse(JSON.parse(content));
-    await importOldmarrAsync(ctx.db, oldmarr, input.configuration);
-  }),
+  importOldmarrConfig: permissionRequiredProcedure
+    .requiresPermission("board-create")
+    .input(importJsonFileSchema)
+    .mutation(async ({ input, ctx }) => {
+      const content = await input.file.text();
+      const oldmarr = oldmarrConfigSchema.parse(JSON.parse(content));
+      await importOldmarrAsync(ctx.db, oldmarr, input.configuration);
+    }),
 });
 
 const noBoardWithSimilarNameAsync = async (db: Database, name: string, ignoredIds: string[] = []) => {

packages/api/src/router/invite.ts

@@ -6,11 +6,12 @@ import { invites } from "@homarr/db/schema/sqlite";
 import { selectInviteSchema } from "@homarr/db/validationSchemas";
 import { z } from "@homarr/validation";
 
-import { createTRPCRouter, protectedProcedure } from "../trpc";
+import { createTRPCRouter, permissionRequiredProcedure } from "../trpc";
 import { throwIfCredentialsDisabled } from "./invite/checks";
 
 export const inviteRouter = createTRPCRouter({
-  getAll: protectedProcedure
+  getAll: permissionRequiredProcedure
+    .requiresPermission("admin")
     .output(
       z.array(
         selectInviteSchema
@@ -40,7 +41,8 @@ export const inviteRouter = createTRPCRouter({
         },
       });
     }),
-  createInvite: protectedProcedure
+  createInvite: permissionRequiredProcedure
+    .requiresPermission("admin")
     .input(
       z.object({
         expirationDate: z.date(),
@@ -65,7 +67,8 @@ export const inviteRouter = createTRPCRouter({
         token,
       };
     }),
-  deleteInvite: protectedProcedure
+  deleteInvite: permissionRequiredProcedure
+    .requiresPermission("admin")
     .input(
       z.object({
         id: z.string(),

packages/api/src/router/serverSettings.ts

@@ -3,17 +3,18 @@ import type { ServerSettings } from "@homarr/server-settings";
 import { defaultServerSettingsKeys } from "@homarr/server-settings";
 import { validation, z } from "@homarr/validation";
 
-import { createTRPCRouter, onboardingProcedure, protectedProcedure, publicProcedure } from "../trpc";
+import { createTRPCRouter, onboardingProcedure, permissionRequiredProcedure, publicProcedure } from "../trpc";
 import { nextOnboardingStepAsync } from "./onboard/onboard-queries";
 
 export const serverSettingsRouter = createTRPCRouter({
   getCulture: publicProcedure.query(async ({ ctx }) => {
     return await getServerSettingByKeyAsync(ctx.db, "culture");
   }),
-  getAll: protectedProcedure.query(async ({ ctx }) => {
+  getAll: permissionRequiredProcedure.requiresPermission("admin").query(async ({ ctx }) => {
     return await getServerSettingsAsync(ctx.db);
   }),
-  saveSettings: protectedProcedure
+  saveSettings: permissionRequiredProcedure
+    .requiresPermission("admin")
     .input(
       z.object({
         settingsKey: z.enum(defaultServerSettingsKeys),

packages/api/src/router/test/invite.spec.ts

@@ -11,7 +11,7 @@ import { inviteRouter } from "../invite";
 const defaultSession = {
   user: {
     id: createId(),
-    permissions: [],
+    permissions: ["admin"],
     colorScheme: "light",
   },
   expires: new Date().toISOString(),

packages/api/src/router/test/serverSettings.spec.ts

@@ -15,7 +15,7 @@ vi.mock("@homarr/auth", () => ({ auth: () => ({}) as Session }));
 const defaultSession = {
   user: {
     id: createId(),
-    permissions: [],
+    permissions: ["admin"],
     colorScheme: "light",
   },
   expires: new Date().toISOString(),

packages/api/src/router/update-checker.ts

@@ -1,9 +1,9 @@
 import { updateCheckerRequestHandler } from "@homarr/request-handler/update-checker";
 
-import { createTRPCRouter, protectedProcedure } from "../trpc";
+import { createTRPCRouter, permissionRequiredProcedure } from "../trpc";
 
 export const updateCheckerRouter = createTRPCRouter({
-  getAvailableUpdates: protectedProcedure.query(async () => {
+  getAvailableUpdates: permissionRequiredProcedure.requiresPermission("admin").query(async () => {
     const handler = updateCheckerRequestHandler.handler({});
     const data = await handler.getCachedOrUpdatedDataAsync({});
     return data.data.availableUpdates;

packages/api/src/router/widgets/dns-hole.ts

@@ -10,7 +10,7 @@ import { controlsInputSchema } from "@homarr/integrations/types";
 import { dnsHoleRequestHandler } from "@homarr/request-handler/dns-hole";
 
 import { createManyIntegrationMiddleware, createOneIntegrationMiddleware } from "../../middlewares/integration";
-import { createTRPCRouter, publicProcedure } from "../../trpc";
+import { createTRPCRouter, protectedProcedure, publicProcedure } from "../../trpc";
 
 export const dnsHoleRouter = createTRPCRouter({
   summary: publicProcedure
@@ -62,7 +62,7 @@ export const dnsHoleRouter = createTRPCRouter({
       });
     }),
 
-  enable: publicProcedure
+  enable: protectedProcedure
     .unstable_concat(createOneIntegrationMiddleware("interact", ...getIntegrationKindsByCategory("dnsHole")))
     .mutation(async ({ ctx: { integration } }) => {
       const client = integrationCreator(integration);
@@ -75,7 +75,7 @@ export const dnsHoleRouter = createTRPCRouter({
       });
     }),
 
-  disable: publicProcedure
+  disable: protectedProcedure
     .input(controlsInputSchema)
     .unstable_concat(createOneIntegrationMiddleware("interact", ...getIntegrationKindsByCategory("dnsHole")))
     .mutation(async ({ ctx: { integration }, input }) => {

packages/api/src/router/widgets/indexer-manager.ts

@@ -9,7 +9,7 @@ import { indexerManagerRequestHandler } from "@homarr/request-handler/indexer-ma
 
 import type { IntegrationAction } from "../../middlewares/integration";
 import { createManyIntegrationMiddleware } from "../../middlewares/integration";
-import { createTRPCRouter, publicProcedure } from "../../trpc";
+import { createTRPCRouter, protectedProcedure, publicProcedure } from "../../trpc";
 
 const createIndexerManagerIntegrationMiddleware = (action: IntegrationAction) =>
   createManyIntegrationMiddleware(action, ...getIntegrationKindsByCategory("indexerManager"));
@@ -54,7 +54,7 @@ export const indexerManagerRouter = createTRPCRouter({
         };
       });
     }),
-  testAllIndexers: publicProcedure
+  testAllIndexers: protectedProcedure
     .unstable_concat(createIndexerManagerIntegrationMiddleware("interact"))
     .mutation(async ({ ctx }) => {
       await Promise.all(

packages/api/src/router/widgets/notebook.ts

@@ -5,10 +5,10 @@ import { eq } from "@homarr/db";
 import { items } from "@homarr/db/schema/sqlite";
 import { z } from "@homarr/validation";
 
-import { createTRPCRouter, publicProcedure } from "../../trpc";
+import { createTRPCRouter, protectedProcedure } from "../../trpc";
 
 export const notebookRouter = createTRPCRouter({
-  updateContent: publicProcedure
+  updateContent: protectedProcedure
     .input(
       z.object({
         itemId: z.string(),

packages/api/src/router/widgets/smart-home.ts

@@ -7,7 +7,7 @@ import { z } from "@homarr/validation";
 
 import type { IntegrationAction } from "../../middlewares/integration";
 import { createOneIntegrationMiddleware } from "../../middlewares/integration";
-import { createTRPCRouter, publicProcedure } from "../../trpc";
+import { createTRPCRouter, protectedProcedure, publicProcedure } from "../../trpc";
 
 const createSmartHomeIntegrationMiddleware = (action: IntegrationAction) =>
   createOneIntegrationMiddleware(action, ...getIntegrationKindsByCategory("smartHomeServer"));
@@ -41,7 +41,7 @@ export const smartHomeRouter = createTRPCRouter({
         };
       });
     }),
-  switchEntity: publicProcedure
+  switchEntity: protectedProcedure
     .unstable_concat(createSmartHomeIntegrationMiddleware("interact"))
     .input(z.object({ entityId: z.string() }))
     .mutation(async ({ ctx: { integration }, input }) => {
@@ -53,7 +53,7 @@ export const smartHomeRouter = createTRPCRouter({
 
       return success;
     }),
-  executeAutomation: publicProcedure
+  executeAutomation: protectedProcedure
     .unstable_concat(createSmartHomeIntegrationMiddleware("interact"))
     .input(z.object({ automationId: z.string() }))
     .mutation(async ({ ctx: { integration }, input }) => {