Fixes cross org connection registry (#2083)

* Fixes cross org connection registry

Signed-off-by: Marcos Candeia <marrcooos@gmail.com>

* Add include tools

Signed-off-by: Marcos Candeia <marrcooos@gmail.com>

---------

Signed-off-by: Marcos Candeia <marrcooos@gmail.com>

Author: mcandeia

apps/mesh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/mesh",
-  "version": "1.0.0-alpha.22",
+  "version": "1.0.0-alpha.23",
   "description": "MCP Mesh - Self-hostable MCP Gateway for managing AI connections and tools",
   "license": "MIT",
   "author": "Deco team",

apps/mesh/src/storage/connection.ts

@@ -63,6 +63,10 @@ export class ConnectionStorage implements ConnectionStoragePort {
     const existing = await this.findById(id);
 
     if (existing) {
+      // Only allow update if same organization - prevent cross-org hijacking
+      if (existing.organization_id !== data.organization_id) {
+        throw new Error("Connection ID already exists");
+      }
       return this.update(id, data);
     }
 

apps/mesh/src/tools/connection/get.ts

@@ -9,6 +9,7 @@ import {
   createCollectionGetOutputSchema,
 } from "@decocms/bindings/collections";
 import { defineTool } from "../../core/define-tool";
+import { requireOrganization } from "../../core/mesh-context";
 import { ConnectionEntitySchema } from "./schema";
 
 /**
@@ -26,13 +27,17 @@ export const COLLECTION_CONNECTIONS_GET = defineTool({
   outputSchema: ConnectionGetOutputSchema,
 
   handler: async (input, ctx) => {
+    // Require organization context
+    const organization = requireOrganization(ctx);
+
     // Check authorization
     await ctx.access.check();
 
     // Get connection
     const connection = await ctx.storage.connections.findById(input.id);
 
-    if (!connection) {
+    // Verify connection exists and belongs to the current organization
+    if (!connection || connection.organization_id !== organization.id) {
       return { item: null };
     }
 

apps/mesh/src/tools/connection/test.ts

@@ -6,6 +6,7 @@
 
 import { z } from "zod";
 import { defineTool } from "../../core/define-tool";
+import { requireOrganization } from "../../core/mesh-context";
 
 export const CONNECTION_TEST = defineTool({
   name: "CONNECTION_TEST",
@@ -22,9 +23,18 @@ export const CONNECTION_TEST = defineTool({
   }),
 
   handler: async (input, ctx) => {
+    // Require organization context
+    const organization = requireOrganization(ctx);
+
     // Check authorization
     await ctx.access.check();
 
+    // Fetch connection to verify org ownership before testing
+    const connection = await ctx.storage.connections.findById(input.id);
+    if (!connection || connection.organization_id !== organization.id) {
+      throw new Error("Connection not found");
+    }
+
     // Test connection
     const result = await ctx.storage.connections.testConnection(input.id);
 

apps/mesh/src/tools/connection/update.ts

@@ -69,20 +69,14 @@ async function validateConfiguration(
     if (refConnectionId === WellKnownMCPId.SELF) {
       continue;
     }
-    // Verify connection exists
+    // Verify connection exists and belongs to same organization
+    // Use consistent error message to prevent cross-org information disclosure
     const refConnection =
       await ctx.storage.connections.findById(refConnectionId);
-    if (!refConnection) {
+    if (!refConnection || refConnection.organization_id !== organizationId) {
       throw new Error(`Referenced connection not found: ${refConnectionId}`);
     }
 
-    // Verify connection belongs to same organization
-    if (refConnection.organization_id !== organizationId) {
-      throw new Error(
-        `Referenced connection ${refConnectionId} does not belong to organization ${organizationId}`,
-      );
-    }
-
     // Verify user has access to the referenced connection
     try {
       await ctx.access.check(refConnectionId);

apps/mesh/src/web/hooks/use-binding-schema-from-registry.ts

@@ -121,7 +121,7 @@ export function useBindingSchemaFromRegistry(
 
   // Build query input params using proper WhereExpression format
   const toolInputParams = parsedAppName
-    ? { where: { appName: parsedAppName } }
+    ? { where: { appName: parsedAppName }, includeTools: true }
     : {};
 
   // Create queries for all registries in parallel