Skip to content

fix(search): return all services to owners and admins in *.search - #5781

Open
1sakshm wants to merge 1 commit into
Dokploy:canaryfrom
1sakshm:fix/search-owner-admin-access
Open

1sakshm wants to merge 1 commit into
Dokploy:canaryfrom
1sakshm:fix/search-owner-admin-access

Conversation

@1sakshm

@1sakshm 1sakshm commented Oct 26, 2026 •

Copy link
Copy Markdown
Contributor

What is this PR about?

The search procedures of the application, compose, postgres, mysql, mariadb, mongo and redis routers always limited results to the caller's accessedServices. A service is only added to that list for the member who created it, so:

  • owners and admins don't see services created by other users, imported, or created before the entry existed, even though *.one and the dashboard show them;
  • an owner or admin with an empty accessedServices list gets { items: [], total: 0 } from every search.

The filter now applies only to members, the same way checkServiceAccess and project.one exempt the owner and admin roles. For members the behaviour is unchanged.

Added apps/dokploy/__test__/permissions/search-service-access.test.ts, which calls search on each of the seven routers and checks that:

  • owners and admins get every service in the organization, without the member lookup;
  • members are limited to their accessed services;
  • members without accessed services get an empty result.

The owner and admin cases fail on canary without this change.

Checklist

Before submitting this PR, please make sure that:

Issues related (if applicable)

closes #5361

🤖 Generated with Claude Code

RetriggerView in GreptileConfidence Score: 4/5

The PR appears safe to merge, with a non-blocking improvement to the count-query tests.

Summary

Updates seven service searches so owners and admins can find all services in their active organization.

  • Owners and admins can search every matching service in their organization.

Reviews (1) · Last reviewed commit: "fix(search): return all services to owne..." · Reviewed by Greptile

The search procedures of application, compose, postgres, mysql,
mariadb, mongo and redis always filtered results by the caller's
accessedServices. A service only lands in that list for the member who
created it, so owners and admins missed services created by others and
got nothing when their list was empty. Apply the filter only to members,
as checkServiceAccess and project.one already do.

Closes Dokploy#5361

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@1sakshm
1sakshm requested a review from Siumauricio as a code owner October 26, 2026 03:51
Comment on lines +72 to +73
const whereParams = () =>
new PgDialect().sqlToQuery(whereClauses[0] as SQL).params;

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Count filters go unchecked

whereParams() checks only the items query. The count query is never checked, and its mock always returns 1, so these tests would still pass if that query lost the organization or member filter. Assert that both recorded clauses contain the expected parameters.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

compose.search omits services missing from member accessedServices, even for owners/admins

1 participant