fix(gateway): filter projects by ownership — close data privacy leak (#202)

Co-authored-by: Jason Woltje <jason@diversecanvas.com>
Co-committed-by: Jason Woltje <jason@diversecanvas.com>

packages/brain/src/projects.spec.ts

@@ -0,0 +1,82 @@
+import { describe, it, expect, vi } from 'vitest';
+import { createProjectsRepo } from './projects.js';
+
+/**
+ * Build a minimal Drizzle mock. Each call to db.select() returns a fresh
+ * chain that resolves `where()` to the provided rows for that call.
+ *
+ * `calls` is an ordered list: the first item is returned for the first
+ * db.select() call, the second for the second, and so on.
+ */
+function makeDb(calls: unknown[][]) {
+  let callIndex = 0;
+  const selectSpy = vi.fn(() => {
+    const rows = calls[callIndex++] ?? [];
+    const chain = {
+      where: vi.fn().mockResolvedValue(rows),
+    } as { where: ReturnType<typeof vi.fn>; from?: ReturnType<typeof vi.fn> };
+    // from() returns the chain so .where() can be chained, but also resolves
+    // directly (as a thenable) for queries with no .where() call.
+    chain.from = vi.fn(() => Object.assign(Promise.resolve(rows), chain));
+    return chain;
+  });
+  return { select: selectSpy };
+}
+
+describe('createProjectsRepo — findAllForUser', () => {
+  it('filters by userId when user has no team memberships', async () => {
+    // First select: teamMembers query → empty
+    // Second select: projects query → one owned project
+    const db = makeDb([
+      [], // teamMembers rows
+      [{ id: 'p1', ownerId: 'user-1', teamId: null, ownerType: 'user' }],
+    ]);
+    const repo = createProjectsRepo(db as never);
+
+    const result = await repo.findAllForUser('user-1');
+
+    expect(db.select).toHaveBeenCalledTimes(2);
+    expect(result).toHaveLength(1);
+    expect(result[0]?.id).toBe('p1');
+  });
+
+  it('includes team projects when user is a team member', async () => {
+    // First select: teamMembers → user belongs to one team
+    // Second select: projects query → two projects (own + team)
+    const db = makeDb([
+      [{ teamId: 'team-1' }],
+      [
+        { id: 'p1', ownerId: 'user-1', teamId: null, ownerType: 'user' },
+        { id: 'p2', ownerId: null, teamId: 'team-1', ownerType: 'team' },
+      ],
+    ]);
+    const repo = createProjectsRepo(db as never);
+
+    const result = await repo.findAllForUser('user-1');
+
+    expect(db.select).toHaveBeenCalledTimes(2);
+    expect(result).toHaveLength(2);
+  });
+
+  it('returns empty array when user has no projects and no teams', async () => {
+    const db = makeDb([[], []]);
+    const repo = createProjectsRepo(db as never);
+
+    const result = await repo.findAllForUser('user-no-projects');
+    expect(result).toHaveLength(0);
+  });
+});
+
+describe('createProjectsRepo — findAll', () => {
+  it('returns all rows without any user filter', async () => {
+    const rows = [
+      { id: 'p1', ownerId: 'user-1', teamId: null, ownerType: 'user' },
+      { id: 'p2', ownerId: 'user-2', teamId: null, ownerType: 'user' },
+    ];
+    const db = makeDb([rows]);
+    const repo = createProjectsRepo(db as never);
+
+    const result = await repo.findAll();
+    expect(result).toHaveLength(2);
+  });
+});

packages/brain/src/projects.ts

@@ -1,4 +1,4 @@
-import { eq, type Db, projects } from '@mosaic/db';
+import { eq, or, inArray, type Db, projects, teamMembers } from '@mosaic/db';
 
 export type Project = typeof projects.$inferSelect;
 export type NewProject = typeof projects.$inferInsert;
@@ -9,6 +9,31 @@ export function createProjectsRepo(db: Db) {
       return db.select().from(projects);
     },
 
+    /**
+     * Return only the projects visible to a given user:
+     *   – projects directly owned by the user (ownerType = 'user', ownerId = userId), OR
+     *   – projects owned by a team the user belongs to (ownerType = 'team', teamId IN user's teams)
+     */
+    async findAllForUser(userId: string): Promise<Project[]> {
+      // Fetch the team IDs the user is a member of.
+      const memberRows = await db
+        .select({ teamId: teamMembers.teamId })
+        .from(teamMembers)
+        .where(eq(teamMembers.userId, userId));
+
+      const teamIds = memberRows.map((r) => r.teamId);
+
+      if (teamIds.length === 0) {
+        // No team memberships — return only directly owned projects.
+        return db.select().from(projects).where(eq(projects.ownerId, userId));
+      }
+
+      return db
+        .select()
+        .from(projects)
+        .where(or(eq(projects.ownerId, userId), inArray(projects.teamId, teamIds)));
+    },
+
     async findById(id: string): Promise<Project | undefined> {
       const rows = await db.select().from(projects).where(eq(projects.id, id));
       return rows[0];