feat(cloud-security): implement organization-based authorization for scan endpoints

Author: Marfuen

apps/api/src/cloud-security/cloud-security.controller.ts

@@ -3,12 +3,14 @@ import {
   Post,
   Get,
   Param,
-  Body,
   Headers,
   Logger,
   HttpException,
   HttpStatus,
+  UseGuards,
 } from '@nestjs/common';
+import { HybridAuthGuard } from '../auth/hybrid-auth.guard';
+import { OrganizationId } from '../auth/auth-context.decorator';
 import { CloudSecurityService } from './cloud-security.service';
 
 @Controller({ path: 'cloud-security', version: '1' })
@@ -57,17 +59,11 @@ export class CloudSecurityController {
   }
 
   @Post('trigger/:connectionId')
+  @UseGuards(HybridAuthGuard)
   async triggerScan(
     @Param('connectionId') connectionId: string,
-    @Body('organizationId') organizationId: string,
+    @OrganizationId() organizationId: string,
   ) {
-    if (!organizationId) {
-      throw new HttpException(
-        'Organization ID required',
-        HttpStatus.BAD_REQUEST,
-      );
-    }
-
     this.logger.log(
       `Cloud security scan trigger requested for connection ${connectionId}`,
     );
@@ -86,9 +82,16 @@ export class CloudSecurityController {
   }
 
   @Get('runs/:runId')
-  async getRunStatus(@Param('runId') runId: string) {
+  @UseGuards(HybridAuthGuard)
+  async getRunStatus(
+    @Param('runId') runId: string,
+    @OrganizationId() organizationId: string,
+  ) {
     try {
-      return await this.cloudSecurityService.getRunStatus(runId);
+      return await this.cloudSecurityService.getRunStatus(
+        runId,
+        organizationId,
+      );
     } catch (error) {
       const message =
         error instanceof Error ? error.message : 'Failed to get run status';

apps/api/src/cloud-security/cloud-security.module.ts

@@ -5,9 +5,10 @@ import { GCPSecurityService } from './providers/gcp-security.service';
 import { AWSSecurityService } from './providers/aws-security.service';
 import { AzureSecurityService } from './providers/azure-security.service';
 import { IntegrationPlatformModule } from '../integration-platform/integration-platform.module';
+import { AuthModule } from '../auth/auth.module';
 
 @Module({
-  imports: [IntegrationPlatformModule],
+  imports: [IntegrationPlatformModule, AuthModule],
   controllers: [CloudSecurityController],
   providers: [
     CloudSecurityService,

apps/api/src/cloud-security/cloud-security.service.ts

@@ -33,6 +33,15 @@ export interface ScanResult {
 export class CloudSecurityService {
   private readonly logger = new Logger(CloudSecurityService.name);
 
+  // Track which organization owns each trigger.dev run for authorization
+  private readonly runOwnership = new Map<
+    string,
+    { organizationId: string; createdAt: number }
+  >();
+
+  // Clean up stale entries older than 10 minutes
+  private readonly RUN_OWNERSHIP_TTL_MS = 10 * 60 * 1000;
+
   constructor(
     private readonly credentialVaultService: CredentialVaultService,
     private readonly oauthCredentialsService: OAuthCredentialsService,
@@ -250,21 +259,49 @@ export class CloudSecurityService {
       runId: handle.id,
     });
 
+    // Track ownership for authorization on status checks
+    this.runOwnership.set(handle.id, {
+      organizationId,
+      createdAt: Date.now(),
+    });
+    this.cleanupStaleRuns();
+
     return { runId: handle.id };
   }
 
   async getRunStatus(
     runId: string,
+    organizationId: string,
   ): Promise<{ completed: boolean; success: boolean; output: unknown }> {
+    // Verify the caller's organization owns this run
+    const ownership = this.runOwnership.get(runId);
+    if (!ownership || ownership.organizationId !== organizationId) {
+      throw new Error('Run not found');
+    }
+
     const run = await runs.retrieve(runId);
 
+    // Clean up completed runs from the ownership map
+    if (run.isCompleted) {
+      this.runOwnership.delete(runId);
+    }
+
     return {
       completed: run.isCompleted,
       success: run.isCompleted ? run.isSuccess : false,
       output: run.isCompleted ? run.output : null,
     };
   }
 
+  private cleanupStaleRuns(): void {
+    const now = Date.now();
+    for (const [runId, entry] of this.runOwnership) {
+      if (now - entry.createdAt > this.RUN_OWNERSHIP_TTL_MS) {
+        this.runOwnership.delete(runId);
+      }
+    }
+  }
+
   private async storeFindings(
     connectionId: string,
     provider: string,

apps/app/src/app/(app)/[orgId]/cloud-tests/actions/run-platform-scan.ts

@@ -8,6 +8,28 @@ import { headers } from 'next/headers';
 const MAX_POLL_ATTEMPTS = 150; // Max 5 minutes (150 * 2 seconds)
 const POLL_INTERVAL_MS = 2000;
 
+/**
+ * Get auth headers for calling guarded API endpoints server-side.
+ * Uses Better Auth's jwt plugin to generate a Bearer token from the session cookie.
+ */
+async function getAuthHeaders(organizationId: string): Promise<Record<string, string>> {
+  const reqHeaders = await headers();
+  const authHeaders: Record<string, string> = {
+    'X-Organization-Id': organizationId,
+  };
+
+  // Get a JWT from Better Auth using the session cookie
+  const tokenResponse = await auth.api.getToken({
+    headers: reqHeaders,
+  });
+
+  if (tokenResponse?.token) {
+    authHeaders['Authorization'] = `Bearer ${tokenResponse.token}`;
+  }
+
+  return authHeaders;
+}
+
 /**
  * Run cloud security scan for a new platform connection.
  * Triggers a background task via the NestJS API and polls for completion,
@@ -36,10 +58,13 @@ export const runPlatformScan = async (connectionId: string) => {
   }
 
   try {
+    const authHeaders = await getAuthHeaders(orgId);
+
     // Trigger the scan via API (task is defined in the API's trigger.dev project)
     const triggerResponse = await serverApi.post<{ runId: string }>(
       `/v1/cloud-security/trigger/${connectionId}`,
-      { organizationId: orgId },
+      undefined,
+      authHeaders,
     );
 
     if (triggerResponse.error || !triggerResponse.data?.runId) {
@@ -64,7 +89,7 @@ export const runPlatformScan = async (connectionId: string) => {
           provider?: string;
           scannedAt?: string;
         } | null;
-      }>(`/v1/cloud-security/runs/${runId}`);
+      }>(`/v1/cloud-security/runs/${runId}`, authHeaders);
 
       if (statusResponse.error) {
         return {

apps/app/src/lib/server-api-client.ts

@@ -11,6 +11,7 @@ interface ApiResponse<T = unknown> {
 interface CallOptions {
   method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
   body?: unknown;
+  headers?: Record<string, string>;
 }
 
 /**
@@ -21,7 +22,7 @@ async function call<T = unknown>(
   endpoint: string,
   options: CallOptions = {},
 ): Promise<ApiResponse<T>> {
-  const { method = 'GET', body } = options;
+  const { method = 'GET', body, headers: customHeaders } = options;
 
   const requestHeaders: Record<string, string> = {
     'Content-Type': 'application/json',
@@ -33,6 +34,11 @@ async function call<T = unknown>(
     requestHeaders['Cookie'] = cookieHeader;
   }
 
+  // Apply custom headers (e.g. Authorization, X-Organization-Id)
+  if (customHeaders) {
+    Object.assign(requestHeaders, customHeaders);
+  }
+
   try {
     const response = await fetch(`${API_BASE_URL}${endpoint}`, {
       method,
@@ -67,16 +73,18 @@ async function call<T = unknown>(
 }
 
 export const serverApi = {
-  get: <T = unknown>(endpoint: string) => call<T>(endpoint, { method: 'GET' }),
+  get: <T = unknown>(endpoint: string, headers?: Record<string, string>) =>
+    call<T>(endpoint, { method: 'GET', headers }),
 
-  post: <T = unknown>(endpoint: string, body?: unknown) =>
-    call<T>(endpoint, { method: 'POST', body }),
+  post: <T = unknown>(endpoint: string, body?: unknown, headers?: Record<string, string>) =>
+    call<T>(endpoint, { method: 'POST', body, headers }),
 
-  put: <T = unknown>(endpoint: string, body?: unknown) =>
-    call<T>(endpoint, { method: 'PUT', body }),
+  put: <T = unknown>(endpoint: string, body?: unknown, headers?: Record<string, string>) =>
+    call<T>(endpoint, { method: 'PUT', body, headers }),
 
-  patch: <T = unknown>(endpoint: string, body?: unknown) =>
-    call<T>(endpoint, { method: 'PATCH', body }),
+  patch: <T = unknown>(endpoint: string, body?: unknown, headers?: Record<string, string>) =>
+    call<T>(endpoint, { method: 'PATCH', body, headers }),
 
-  delete: <T = unknown>(endpoint: string) => call<T>(endpoint, { method: 'DELETE' }),
+  delete: <T = unknown>(endpoint: string, headers?: Record<string, string>) =>
+    call<T>(endpoint, { method: 'DELETE', headers }),
 };