security(idor): scope vmware/xhm migration list+detail to the caller's clusters

Final re-scan residual: /api/vmware/migrations and /api/xhm/migrations (list + detail) returned
every tenant's migration tasks to any vm.migrate holder. Now filtered/gated so a caller only sees
a migration touching a cluster they can reach (source or target); detail returns 404 otherwise. 277 tests.

Author: MrMasterbay

pegaprox/api/vmware.py

@@ -1126,9 +1126,16 @@ def start_vmware_migration(vmware_id, vm_id):
 
 @bp.route('/api/vmware/migrations', methods=['GET'])
 @require_auth(perms=['vmware.vm.migrate'])
+def _migration_reachable(t):
+    # NS Jul 2026 (CodeAnt IDOR) — a caller may see a migration only if they can reach one of the
+    # clusters it touches (source or target). Tasks with no determinable cluster are shown.
+    cids = [c for c in (getattr(t, 'target_cluster', None), getattr(t, 'source_cluster', None)) if c]
+    return (not cids) or any(check_cluster_access(c)[0] for c in cids)
+
+
 def list_vmware_migrations():
     """List all active and recent migrations"""
-    return jsonify([t.to_dict() for t in _vmware_migrations.values()])
+    return jsonify([t.to_dict() for t in _vmware_migrations.values() if _migration_reachable(t)])
 
 
 @bp.route('/api/vmware/migrations/<mid>', methods=['GET'])
@@ -1137,6 +1144,8 @@ def get_vmware_migration_status(mid):
     """Get detailed status of a specific migration"""
     if mid not in _vmware_migrations:
         return jsonify({'error': 'Migration not found'}), 404
+    if not _migration_reachable(_vmware_migrations[mid]):
+        return jsonify({'error': 'Migration not found'}), 404
     return jsonify(_vmware_migrations[mid].to_dict())
 
 

pegaprox/api/xhm.py

@@ -193,13 +193,22 @@ def xhm_start():
 
 @bp.route('/api/xhm/migrations', methods=['GET'])
 @require_auth(perms=['vm.migrate'])
+def _xhm_reachable(t):
+    # NS Jul 2026 (CodeAnt IDOR) — show a migration only if the caller reaches one of its clusters.
+    from pegaprox.api.helpers import check_cluster_access
+    cids = [c for c in (getattr(t, 'target_cluster', None), getattr(t, 'source_cluster', None)) if c]
+    return (not cids) or any(check_cluster_access(c)[0] for c in cids)
+
+
 def xhm_list():
-    return jsonify([t.to_dict() for t in _xhm_migrations.values()])
+    return jsonify([t.to_dict() for t in _xhm_migrations.values() if _xhm_reachable(t)])
 
 
 @bp.route('/api/xhm/migrations/<mid>', methods=['GET'])
 @require_auth(perms=['vm.migrate'])
 def xhm_detail(mid):
     if mid not in _xhm_migrations:
         return jsonify({'error': 'Migration not found'}), 404
+    if not _xhm_reachable(_xhm_migrations[mid]):
+        return jsonify({'error': 'Migration not found'}), 404
     return jsonify(_xhm_migrations[mid].to_dict())