feat: enforce team membership validation for cloudtty access

src/api-v2.authz.test.ts

@@ -1830,7 +1830,6 @@ describe('API V2 authz tests', () => {
           .expect(200)
       })
 
-      //TODO check if this is the desired behavior
       test('team member cannot connect cloudtty for other team', async () => {
         await agent
           .get('/v2/cloudtty')
@@ -1840,6 +1839,32 @@ describe('API V2 authz tests', () => {
       })
     })
 
+    describe('Team Admin', () => {
+      test('team admin can connect cloudtty for own team', async () => {
+        await agent
+          .get('/v2/cloudtty')
+          .query({ teamId: 'team1' })
+          .set('Authorization', `Bearer ${teamAdminToken}`)
+          .expect(200)
+      })
+
+      test('team admin cannot connect cloudtty for other team', async () => {
+        await agent
+          .get('/v2/cloudtty')
+          .query({ teamId: 'team2' })
+          .set('Authorization', `Bearer ${teamAdminToken}`)
+          .expect(403)
+      })
+
+      test('team admin cannot delete cloudtty for other team', async () => {
+        await agent
+          .delete('/v2/cloudtty')
+          .query({ teamId: 'team2' })
+          .set('Authorization', `Bearer ${teamAdminToken}`)
+          .expect(403)
+      })
+    })
+
     describe('Unauthenticated', () => {
       test('anonymous user cannot connect cloudtty', async () => {
         await agent.get('/v2/cloudtty').query({ teamId: 'team1' }).expect(401)

src/openapi/cloudtty.yaml

@@ -6,10 +6,10 @@ Cloudtty:
       - update-any
       - delete-any
     teamAdmin:
-      - create-any
-      - read-any
-      - update-any
-      - delete-any
+      - create
+      - read
+      - update
+      - delete
     teamMember:
       - create
       - read

src/otomi-stack.ts

@@ -1775,6 +1775,9 @@ export default class OtomiStack {
 
   async connectCloudtty(teamId: string, sessionUser: SessionUser): Promise<Cloudtty> {
     const isAdmin = sessionUser.isPlatformAdmin
+    if (!isAdmin && !sessionUser.teams.includes(teamId)) {
+      throw new ForbiddenError('Cannot open a cloud shell in a team you are not a member of.')
+    }
     const targetNamespace = isAdmin ? 'team-admin' : `team-${teamId}`
     if (!sessionUser.sub) {
       debug('No user sub found, cannot connect to shell.')
@@ -1820,6 +1823,9 @@ export default class OtomiStack {
   }
 
   async deleteCloudtty(teamId: string, sessionUser: SessionUser): Promise<void> {
+    if (!sessionUser.isPlatformAdmin && !sessionUser.teams.includes(teamId)) {
+      throw new ForbiddenError('Cannot delete a cloud shell in a team you are not a member of.')
+    }
     await this.getCloudTty().deleteTty(teamId, sessionUser)
   }