fix: keys setting vulns

unkeyed · Dec 6, 2024 · 78f9c47 · 78f9c47
1 parent bca5871
commit 78f9c47
Show file tree

Hide file tree

Showing 4 changed files with 3 additions and 12 deletions.
diff --git a/apps/dashboard/app/(app)/apis/[apiId]/settings/default-bytes.tsx b/apps/dashboard/app/(app)/apis/[apiId]/settings/default-bytes.tsx
@@ -19,7 +19,6 @@ import { useForm } from "react-hook-form";
 import { z } from "zod";
 const formSchema = z.object({
   keyAuthId: z.string(),
-  workspaceId: z.string(),
   defaultBytes: z
     .number()
     .min(8, "Byte size needs to be at least 8")
@@ -30,7 +29,6 @@ const formSchema = z.object({
 type Props = {
   keyAuth: {
     id: string;
-    workspaceId: string;
     defaultBytes: number | undefined | null;
   };
 };
@@ -42,7 +40,6 @@ export const DefaultBytes: React.FC<Props> = ({ keyAuth }) => {
     defaultValues: {
       defaultBytes: keyAuth.defaultBytes ?? undefined,
       keyAuthId: keyAuth.id,
-      workspaceId: keyAuth.workspaceId,
     },
   });
 
@@ -78,7 +75,6 @@ export const DefaultBytes: React.FC<Props> = ({ keyAuth }) => {
         </CardHeader>
         <CardContent>
           <div className="flex flex-col space-y-2">
-            <input type="hidden" name="workspaceId" value={keyAuth.workspaceId} />
             <input type="hidden" name="keyAuthId" value={keyAuth.id} />
             <label className="hidden sr-only">Default Bytes</label>
             <FormField

diff --git a/apps/dashboard/app/(app)/apis/[apiId]/settings/default-prefix.tsx b/apps/dashboard/app/(app)/apis/[apiId]/settings/default-prefix.tsx
@@ -17,16 +17,15 @@ import { zodResolver } from "@hookform/resolvers/zod";
 import { useRouter } from "next/navigation";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
+
 const formSchema = z.object({
   keyAuthId: z.string(),
-  workspaceId: z.string(),
   defaultPrefix: z.string(),
 });
 
 type Props = {
   keyAuth: {
     id: string;
-    workspaceId: string;
     defaultPrefix: string | undefined | null;
   };
 };
@@ -38,7 +37,6 @@ export const DefaultPrefix: React.FC<Props> = ({ keyAuth }) => {
     defaultValues: {
       defaultPrefix: keyAuth.defaultPrefix ?? undefined,
       keyAuthId: keyAuth.id,
-      workspaceId: keyAuth.workspaceId,
     },
   });
 
@@ -71,7 +69,6 @@ export const DefaultPrefix: React.FC<Props> = ({ keyAuth }) => {
         </CardHeader>
         <CardContent>
           <div className="flex flex-col space-y-2">
-            <input type="hidden" name="workspaceId" value={keyAuth.workspaceId} />
             <input type="hidden" name="keyAuthId" value={keyAuth.id} />
             <label className="hidden sr-only">Default Prefix</label>
             <FormField

diff --git a/apps/dashboard/lib/trpc/routers/api/setDefaultBytes.ts b/apps/dashboard/lib/trpc/routers/api/setDefaultBytes.ts
@@ -15,7 +15,6 @@ export const setDefaultApiBytes = t.procedure
         .max(255, "Byte size cannot exceed 255")
         .optional(),
       keyAuthId: z.string(),
-      workspaceId: z.string(),
     }),
   )
   .mutation(async ({ ctx, input }) => {
@@ -30,7 +29,7 @@ export const setDefaultApiBytes = t.procedure
             "We were unable to find the KeyAuth. Please try again or contact support@unkey.dev.",
         });
       });
-    if (!keyAuth || keyAuth.workspaceId !== input.workspaceId) {
+    if (!keyAuth) {
       throw new TRPCError({
         code: "NOT_FOUND",
         message:

diff --git a/apps/dashboard/lib/trpc/routers/api/setDefaultPrefix.ts b/apps/dashboard/lib/trpc/routers/api/setDefaultPrefix.ts
@@ -11,7 +11,6 @@ export const setDefaultApiPrefix = t.procedure
     z.object({
       defaultPrefix: z.string().max(8, "Prefix can be a maximum of 8 characters"),
       keyAuthId: z.string(),
-      workspaceId: z.string(),
     }),
   )
   .mutation(async ({ ctx, input }) => {
@@ -25,7 +24,7 @@ export const setDefaultApiPrefix = t.procedure
           message: "We were unable to find KeyAuth. Please try again or contact support@unkey.dev.",
         });
       });
-    if (!keyAuth || keyAuth.workspaceId !== input.workspaceId) {
+    if (!keyAuth) {
       throw new TRPCError({
         code: "NOT_FOUND",
         message: