fix(snapshot): scope GetLastSnapshot query by teamID to prevent unauthorized cross-team access

[AdaAibaby]

Fixes #2637

Problem

Four handlers (sandbox_connect, sandbox_get, sandbox_pause, sandbox_resume) called
SnapshotCache.Get(ctx, sandboxID) which fetches a snapshot by sandbox ID only, then
performed a post-fetch ownership check:

if lastSnapshot.Snapshot.TeamID != teamID {
    return api.NewError(http.StatusNotFound, "snapshot not found")
}

[e2b-atlantis]

Atlantis commands can't be run on fork pull requests. To enable, set --allow-fork-prs or, to disable this message, set --silence-fork-pr-errors

[e2b-atlantis]

Error parsing command: EOF found when expecting closing quote

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c8e62f63f0

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[gemini-code-assist]

Code Review

This pull request introduces a GetByTeam method to the SnapshotCache to enforce team-level scoping for snapshot lookups at the database layer, replacing manual ownership checks in various API handlers. It includes corresponding database queries, comprehensive unit tests, and updates to the OpenAPI specification to support sandbox creation from snapshots. A syntax error was identified in the new test file where the package declaration is duplicated.

[e2b-atlantis]

Atlantis commands can't be run on fork pull requests. To enable, set --allow-fork-prs or, to disable this message, set --silence-fork-pr-errors

[e2b-atlantis]

Error parsing command: EOF found when expecting closing quote

[e2b-atlantis]

Atlantis commands can't be run on fork pull requests. To enable, set --allow-fork-prs or, to disable this message, set --silence-fork-pr-errors

[e2b-atlantis]

Error parsing command: EOF found when expecting closing quote

[e2b-atlantis]

Atlantis commands can't be run on fork pull requests. To enable, set --allow-fork-prs or, to disable this message, set --silence-fork-pr-errors

[e2b-atlantis]

Error parsing command: EOF found when expecting closing quote

[e2b-atlantis]

Atlantis commands can't be run on fork pull requests. To enable, set --allow-fork-prs or, to disable this message, set --silence-fork-pr-errors

[e2b-atlantis]

Error parsing command: EOF found when expecting closing quote

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2f117e07a5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[e2b-atlantis]

Atlantis commands can't be run on fork pull requests. To enable, set --allow-fork-prs or, to disable this message, set --silence-fork-pr-errors

[e2b-atlantis]

Error parsing command: EOF found when expecting closing quote

[e2b-atlantis]

Atlantis commands can't be run on fork pull requests. To enable, set --allow-fork-prs or, to disable this message, set --silence-fork-pr-errors

[e2b-atlantis]

Error parsing command: EOF found when expecting closing quote

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7b9f5f94ed

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[e2b-atlantis]

Atlantis commands can't be run on fork pull requests. To enable, set --allow-fork-prs or, to disable this message, set --silence-fork-pr-errors

[e2b-atlantis]

Error parsing command: EOF found when expecting closing quote

[jakubno]

This isn't really possible as we need to access the snapshot in some places without knowing team ID apriori and we don't want to maintain 2 methods doing the same. Please propose the solution in the issue before starting the implementation next time 🙏🏻

[AdaAibaby]

This isn't really possible as we need to access the snapshot in some places without knowing team ID apriori and we don't want to maintain 2 methods doing the same. Please propose the solution in the issue before starting the implementation next time 🙏🏻

Thanks a lot for the explanation, Jakub — that makes perfect sense.
I didn’t realize some internal paths access snapshots without having the teamID available upfront.
I’ll move the discussion back to #2637​ and propose a solution that works within the current architecture (without introducing a second method).
Appreciate you taking the time to review this 🙏