fix(webapp): scope deployment lookup by environment to prevent cross-env cancel IDOR (#70)

* fix(webapp): scope deployment lookup by environment to prevent cross-env cancel IDOR

The private getDeployment helper in deployment.server.ts resolved worker
deployments scoped only by projectId. Because a single API key authenticates
to one environment but projectId is shared across all environments of a
project, a lower-trust environment key (dev/preview/CI) could cancel, progress,
or request registry credentials for another environment's (e.g. prod)
in-progress deployment if it knew the target's friendlyId.

Scope getDeployment by environmentId instead of projectId, and update the three
call sites (cancelDeployment, progressDeployment, generateRegistryCredentials)
to pass the environment id. The registry-credentials platform call stays
project+region scoped by design.

The dashboard cancel route (resources.$projectId.deployments.$deploymentShortCode.cancel)
is project-scoped by design via RBAC; it now passes the located deployment's
own environmentId so its behavior is preserved.

GHSA-4672-hwv6-gq62

* fix(webapp): remove unused project ID from deployment cancellation

* chore(webapp): format deployment cancellation call

Author: carderne

apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts

@@ -45,7 +45,7 @@ export async function action({ request, params }: ActionFunctionArgs) {
     const deploymentService = new DeploymentService();
 
     return await deploymentService
-      .cancelDeployment(authenticatedEnv, deploymentId, {
+      .cancelDeployment({ id: authenticatedEnv.id }, deploymentId, {
         canceledReason: body.data.reason,
       })
       .match(

apps/webapp/app/routes/resources.$projectId.deployments.$deploymentShortCode.cancel.ts

@@ -75,7 +75,7 @@ export const action = dashboardAction(
         prisma.workerDeployment.findUnique({
           select: {
             friendlyId: true,
-            projectId: true,
+            environmentId: true,
           },
           where: {
             projectId_shortCode: {
@@ -96,10 +96,7 @@ export const action = dashboardAction(
     const result = await verifyProjectMembership()
       .andThen(findDeploymentFriendlyId)
       .andThen((deployment) =>
-        deploymentService.cancelDeployment(
-          { projectId: deployment.projectId },
-          deployment.friendlyId
-        )
+        deploymentService.cancelDeployment({ id: deployment.environmentId }, deployment.friendlyId)
       );
 
     if (result.isErr()) {

apps/webapp/app/v3/services/deployment.server.ts

@@ -169,7 +169,7 @@ export class DeploymentService extends BaseService {
         })
       );
 
-    return this.getDeployment(authenticatedEnv.projectId, friendlyId)
+    return this.getDeployment(authenticatedEnv.id, friendlyId)
       .andThen(validateDeployment)
       .andThen((deployment) => {
         if (deployment.status === "PENDING") {
@@ -191,7 +191,7 @@ export class DeploymentService extends BaseService {
    * @param data Cancelation reason.
    */
   public cancelDeployment(
-    authenticatedEnv: Pick<AuthenticatedEnvironment, "projectId">,
+    authenticatedEnv: Pick<AuthenticatedEnvironment, "id">,
     friendlyId: string,
     data?: Partial<Pick<WorkerDeployment, "canceledReason">>
   ) {
@@ -246,7 +246,7 @@ export class DeploymentService extends BaseService {
         cause: error,
       }));
 
-    return this.getDeployment(authenticatedEnv.projectId, friendlyId)
+    return this.getDeployment(authenticatedEnv.id, friendlyId)
       .andThen(validateDeployment)
       .andThen(cancelDeployment)
       .andThen(({ deployment }) =>
@@ -278,7 +278,7 @@ export class DeploymentService extends BaseService {
    * @param friendlyId The friendly deployment ID.
    */
   public generateRegistryCredentials(
-    authenticatedEnv: Pick<AuthenticatedEnvironment, "projectId">,
+    authenticatedEnv: Pick<AuthenticatedEnvironment, "id" | "projectId">,
     friendlyId: string
   ) {
     const validateDeployment = (
@@ -326,7 +326,7 @@ export class DeploymentService extends BaseService {
         });
       });
 
-    return this.getDeployment(authenticatedEnv.projectId, friendlyId)
+    return this.getDeployment(authenticatedEnv.id, friendlyId)
       .andThen(validateDeployment)
       .andThen(getDeploymentRegion)
       .andThen(generateCredentials);
@@ -472,12 +472,12 @@ export class DeploymentService extends BaseService {
     );
   }
 
-  private getDeployment(projectId: string, friendlyId: string) {
+  private getDeployment(environmentId: string, friendlyId: string) {
     return fromPromise(
       this._prisma.workerDeployment.findFirst({
         where: {
           friendlyId,
-          projectId,
+          environmentId,
         },
         select: {
           status: true,

apps/webapp/app/v3/services/initializeDeployment.server.ts

@@ -286,7 +286,7 @@ export class InitializeDeploymentService extends BaseService {
             });
 
             return deploymentService
-              .cancelDeployment(environment, deployment.friendlyId, {
+              .cancelDeployment({ id: environment.id }, deployment.friendlyId, {
                 canceledReason: "Failed to enqueue build, please try again shortly.",
               })
               .orTee((cancelError) =>