4.8.10 test (#2578)

* fix: auth error

* perf: refresh members

* fix: variable run

* fix: runtime check

* fix: dataset info show

packages/service/support/permission/app/auth.ts

@@ -52,6 +52,11 @@ export const authAppByTmbId = async ({
     if (!app) {
       return Promise.reject(AppErrEnum.unExist);
     }
+
+    if (String(app.teamId) !== teamId) {
+      return Promise.reject(AppErrEnum.unAuthApp);
+    }
+
     const isOwner = tmbPer.isOwner || String(app.tmbId) === String(tmbId);
 
     const { Per, defaultPermission } = await (async () => {

packages/service/support/permission/auth/openapi.ts

@@ -28,6 +28,10 @@ export async function authOpenApiKeyCrud({
       return Promise.reject(OpenApiErrEnum.unExist);
     }
 
+    if (String(openapi.teamId) !== teamId) {
+      return Promise.reject(OpenApiErrEnum.unAuth);
+    }
+
     if (!!openapi.appId) {
       // if is not global openapi, then auth app
       const { app } = await authAppByTmbId({ appId: openapi.appId!, tmbId, per });

packages/service/support/permission/dataset/auth.ts

@@ -43,6 +43,11 @@ export const authDatasetByTmbId = async ({
     if (!dataset) {
       return Promise.reject(DatasetErrEnum.unExist);
     }
+
+    if (String(dataset.teamId) !== teamId) {
+      return Promise.reject(DatasetErrEnum.unAuthDataset);
+    }
+
     const isOwner = tmbPer.isOwner || String(dataset.tmbId) === String(tmbId);
 
     // get dataset permission or inherit permission from parent folder.

packages/service/support/permission/publish/authLink.ts

@@ -29,10 +29,14 @@ export async function authOutLinkCrud({
       return Promise.reject(OutLinkErrEnum.unExist);
     }
 
+    if (String(outLink.teamId) !== teamId) {
+      return Promise.reject(OutLinkErrEnum.unAuthLink);
+    }
+
     const { app } = await authAppByTmbId({
       tmbId,
       appId: outLink.appId,
-      per: per
+      per
     });
 
     return {