Skip to content

Commit eebdf8a

Browse files
committed
fix: solve org unscoped minor issue
validações de unicidade (player_email, riot_puuid, riot_summoner_id) também rodam sem o scope, eliminando os 3x [SECURITY] falsos positivos, o CurrentAttributes é thread-safe e resetado automaticamente ao fim do request
1 parent 6c7ccfe commit eebdf8a

File tree

3 files changed

+6
-2
lines changed

3 files changed

+6
-2
lines changed

app/models/concerns/organization_scoped.rb

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ module OrganizationScoped
1212
org_id = Current.organization_id
1313
if org_id.present?
1414
where(organization_id: org_id)
15+
elsif Current.skip_organization_scope
16+
all
1517
else
1618
# SECURITY: Fail-safe - retorna scope vazio em vez de expor dados de todas as orgs
1719
Rails.logger.error("[SECURITY] OrganizationScoped: organization_id is nil for #{name} - BLOCKING ACCESS")

app/models/current.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,5 @@
33
# Thread-safe storage for request-scoped data
44
# Use Current.organization_id instead of Thread.current[:organization_id]
55
class Current < ActiveSupport::CurrentAttributes
6-
attribute :organization_id, :user_id, :user_role
6+
attribute :organization_id, :user_id, :user_role, :skip_organization_scope
77
end

app/modules/authentication/controllers/auth_controller.rb

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -209,7 +209,9 @@ def player_register
209209

210210
player = build_free_agent_player(player_email, summoner_name, password, discord)
211211

212-
saved = Player.unscoped { player.save }
212+
Current.skip_organization_scope = true
213+
saved = player.save
214+
Current.skip_organization_scope = false
213215

214216
unless saved
215217
return render_error(

0 commit comments

Comments
 (0)