mosaic/stack
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

[BLOCKER] Remove hardcoded workspace ID in Discord service #183

New Issue
Closed
opened 2026-02-02 17:23:22 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-02-02 17:23:22 +00:00
Owner
Copy Link

Problem

Discord service uses hardcoded workspace ID 'default-workspace', completely bypassing multi-tenant isolation. All Discord commands create jobs in the same workspace regardless of which Discord server they originate from.

Location

apps/api/src/bridge/discord/discord.service.ts:283

const result = await this.stitcherService.dispatchJob({
  workspaceId: "default-workspace", // TODO: Get from configuration
  type: "code-task",
  // ...
});

Impact

  • CRITICAL: Multi-tenant security completely broken
  • All Discord servers share the same workspace
  • Cross-tenant data leakage
  • Blocks M4.2-Infrastructure milestone completion
  • Blocks production deployment

Acceptance Criteria

  • Create database table for Discord guild → workspace mapping
  • Implement workspace resolution from Discord guild ID
  • Remove hardcoded 'default-workspace' string
  • Add validation that user has access to resolved workspace
  • Add tests for workspace resolution
  • Document Discord bot setup for workspace mapping

Implementation Notes

  1. Create Prisma schema for guild_workspace_mappings
  2. Add migration
  3. Implement getWorkspaceForGuild() method
  4. Update handleFixCommand() and other command handlers
  5. Add admin endpoint to configure guild → workspace mappings

Testing

  • Test command from guild A creates job in workspace A
  • Test command from guild B creates job in workspace B
  • Test unmapped guild returns error message
  • Test workspace access validation

References

M4.2-Infrastructure verification report (2026-02-02)
Security review agent ID: a1b8b3f

## Problem Discord service uses hardcoded workspace ID 'default-workspace', completely bypassing multi-tenant isolation. All Discord commands create jobs in the same workspace regardless of which Discord server they originate from. ## Location apps/api/src/bridge/discord/discord.service.ts:283 ```typescript const result = await this.stitcherService.dispatchJob({ workspaceId: "default-workspace", // TODO: Get from configuration type: "code-task", // ... }); ``` ## Impact - **CRITICAL**: Multi-tenant security completely broken - All Discord servers share the same workspace - Cross-tenant data leakage - Blocks M4.2-Infrastructure milestone completion - Blocks production deployment ## Acceptance Criteria - [ ] Create database table for Discord guild → workspace mapping - [ ] Implement workspace resolution from Discord guild ID - [ ] Remove hardcoded 'default-workspace' string - [ ] Add validation that user has access to resolved workspace - [ ] Add tests for workspace resolution - [ ] Document Discord bot setup for workspace mapping ## Implementation Notes 1. Create Prisma schema for guild_workspace_mappings 2. Add migration 3. Implement getWorkspaceForGuild() method 4. Update handleFixCommand() and other command handlers 5. Add admin endpoint to configure guild → workspace mappings ## Testing - [ ] Test command from guild A creates job in workspace A - [ ] Test command from guild B creates job in workspace B - [ ] Test unmapped guild returns error message - [ ] Test workspace access validation ## References M4.2-Infrastructure verification report (2026-02-02) Security review agent ID: a1b8b3f
jason.woltje added this to the M4.2-Infrastructure (0.0.4) milestone 2026-02-02 17:23:22 +00:00
jason.woltje added the securityapiapip0 labels 2026-02-02 17:23:22 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
ai
AI/LLM integration
 api
Backend/API work
 api
auth
Authentication
 database
database
Database/schema work
 devops
Docker/deployment
 docs
Documentation
 frontend
graph
knowledge-module
migration
Data migration
 orchestrator
Orchestrator service (apps/orchestrator/)
 p0
Critical priority
 p1
High priority
 p2
Medium priority
 p3
Low priority
 performance
Performance work
 phase-1
phase-2
phase-3
phase-4
phase-5
plugin
MoltBot plugin work
 search
security
Security-related
 setup
Initial setup
 testing
Testing/QA
 web
Frontend work
No Label api api p0 security
Milestone
No items
No Milestone M4.2-Infrastructure (0.0.4)
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaic/stack#183
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?