From e3cba37e8c83baa54495213691b0b9862423a6b4 Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Fri, 27 Feb 2026 04:18:35 +0000 Subject: [PATCH] fix(api,web): resolve RLS context SQL error, workspace guard crash, and projects response unwrapping (#531) Co-authored-by: Jason Woltje Co-committed-by: Jason Woltje --- apps/api/src/common/guards/workspace.guard.ts | 8 ++++---- apps/api/src/prisma/prisma.service.ts | 11 +++++++---- apps/web/src/lib/api/projects.ts | 3 ++- 3 files changed, 13 insertions(+), 9 deletions(-) diff --git a/apps/api/src/common/guards/workspace.guard.ts b/apps/api/src/common/guards/workspace.guard.ts index 75d065f..058441a 100644 --- a/apps/api/src/common/guards/workspace.guard.ts +++ b/apps/api/src/common/guards/workspace.guard.ts @@ -110,10 +110,10 @@ export class WorkspaceGuard implements CanActivate { return paramWorkspaceId; } - // 3. Check request body - const bodyWorkspaceId = request.body.workspaceId; - if (typeof bodyWorkspaceId === "string") { - return bodyWorkspaceId; + // 3. Check request body (body may be undefined for GET requests despite Express typings) + const body = request.body as Record | undefined; + if (body && typeof body.workspaceId === "string") { + return body.workspaceId; } // 4. Check query string (backward compatibility for existing clients) diff --git a/apps/api/src/prisma/prisma.service.ts b/apps/api/src/prisma/prisma.service.ts index 66cfbfd..6721734 100644 --- a/apps/api/src/prisma/prisma.service.ts +++ b/apps/api/src/prisma/prisma.service.ts @@ -140,8 +140,11 @@ export class PrismaService extends PrismaClient implements OnModuleInit, OnModul workspaceId: string, client: PrismaClient = this ): Promise { - await client.$executeRaw`SET LOCAL app.current_user_id = ${userId}`; - await client.$executeRaw`SET LOCAL app.current_workspace_id = ${workspaceId}`; + // Use set_config() instead of SET LOCAL so values are safely parameterized. + // SET LOCAL with Prisma's tagged template produces invalid SQL (bind parameter $1 + // is not supported in SET statements by PostgreSQL). + await client.$executeRaw`SELECT set_config('app.current_user_id', ${userId}, true)`; + await client.$executeRaw`SELECT set_config('app.current_workspace_id', ${workspaceId}, true)`; } /** @@ -151,8 +154,8 @@ export class PrismaService extends PrismaClient implements OnModuleInit, OnModul * @param client - Optional Prisma client (uses 'this' if not provided) */ async clearWorkspaceContext(client: PrismaClient = this): Promise { - await client.$executeRaw`SET LOCAL app.current_user_id = NULL`; - await client.$executeRaw`SET LOCAL app.current_workspace_id = NULL`; + await client.$executeRaw`SELECT set_config('app.current_user_id', '', true)`; + await client.$executeRaw`SELECT set_config('app.current_workspace_id', '', true)`; } /** diff --git a/apps/web/src/lib/api/projects.ts b/apps/web/src/lib/api/projects.ts index 89a11ca..8d68448 100644 --- a/apps/web/src/lib/api/projects.ts +++ b/apps/web/src/lib/api/projects.ts @@ -65,7 +65,8 @@ export interface UpdateProjectDto { * Fetch all projects for a workspace */ export async function fetchProjects(workspaceId?: string): Promise { - return apiGet("/api/projects", workspaceId); + const response = await apiGet<{ data: Project[]; meta?: unknown }>("/api/projects", workspaceId); + return response.data; } /**