fix: channel-config-exposure

app/(customer)/dashboard/(organization)/projects/[projectId]/page.tsx

@@ -54,8 +54,8 @@ export default async function RoutePage(
       ),
     with: {
       databases: true,
-      storagePolicies: { with: { storageChannel: true } },
-      alertPolicies: { with: { notificationChannel: true } },
+      storagePolicies: true,
+      alertPolicies: true,
       retentionPolicy: true,
     },
   });

app/(customer)/dashboard/(organization)/settings/page.tsx

@@ -35,10 +35,14 @@ export default async function RoutePage(props: PageParams<{ slug: string }>) {
         notFound();
     }
 
-    const notificationChannels = await getOrganizationChannels(organization.id);
-    const storageChannels = await getOrganizationStorageChannels(organization.id);
-    const agents = await getOrganizationAgents(organization.id);
     const permissions = computeOrganizationPermissions(activeMember);
+    const notificationChannels = permissions.canManageNotifications
+        ? await getOrganizationChannels(organization.id)
+        : [];
+    const storageChannels = permissions.canManageStorages
+        ? await getOrganizationStorageChannels(organization.id)
+        : [];
+    const agents = await getOrganizationAgents(organization.id);
 
     const users = await db.query.user.findMany({
         where: (fields) => isNull(fields.deletedAt),

src/db/services/notification-channel.ts

@@ -54,9 +54,13 @@ export async function getOrganizationChannels(
   ]);
 
   const seen = new Set<string>();
-  return [...orgChannels, ...systemChannels].filter((c) => {
-    if (seen.has(c.id)) return false;
-    seen.add(c.id);
-    return true;
-  }) as NotificationChannel[];
+  return [...orgChannels, ...systemChannels]
+    .filter((c) => {
+      if (seen.has(c.id)) return false;
+      seen.add(c.id);
+      return true;
+    })
+    .map((c) =>
+      c.organizationId === organizationId ? c : { ...c, config: null },
+    ) as NotificationChannel[];
 }

src/db/services/storage-channel.ts

@@ -49,9 +49,13 @@ export async function getOrganizationStorageChannels(
   ]);
 
   const seen = new Set<string>();
-  return [...orgChannels, ...systemChannels].filter((c) => {
-    if (seen.has(c.id)) return false;
-    seen.add(c.id);
-    return true;
-  }) as StorageChannel[];
+  return [...orgChannels, ...systemChannels]
+    .filter((c) => {
+      if (seen.has(c.id)) return false;
+      seen.add(c.id);
+      return true;
+    })
+    .map((c) =>
+      c.organizationId === organizationId ? c : { ...c, config: null },
+    ) as StorageChannel[];
 }

src/features/database/actions/backup-get-data.action.ts

@@ -8,6 +8,11 @@ import {getOrganizationChannels} from "@/db/services/notification-channel";
 import {getOrganizationStorageChannels} from "@/db/services/storage-channel";
 import {getHealthLast12hLogs} from "@/db/services/healthcheck";
 import {assertCanReadDatabase} from "@/features/database/utils/database-acl";
+import {maskDatabaseSecretsForClient} from "@/features/database/utils/credential-fields";
+
+type ChannelRow = { id: string; name: string; provider: string; enabled: boolean };
+
+const toClientChannel = ({id, name, provider, enabled}: ChannelRow) => ({id, name, provider, enabled});
 
 export const getDatabaseDataAction = userAction
     .inputSchema(
@@ -88,14 +93,14 @@ export const getDatabaseDataAction = userAction
 
         if (database?.project?.organizationId) {
             const organizationChannels = await getOrganizationChannels(database.project.organizationId);
-            activeOrganizationChannels = organizationChannels.filter(channel => channel.enabled);
+            activeOrganizationChannels = organizationChannels.filter(channel => channel.enabled).map(toClientChannel);
 
             const organizationStorageChannels = await getOrganizationStorageChannels(database.project.organizationId);
-            activeOrganizationStorageChannels = organizationStorageChannels.filter(channel => channel.enabled);
+            activeOrganizationStorageChannels = organizationStorageChannels.filter(channel => channel.enabled).map(toClientChannel);
         }
 
         return {
-            database,
+            database: database && maskDatabaseSecretsForClient(database),
             // @ts-ignore
             activeOrganizationChannels,
             // @ts-ignore

src/features/database/actions/backup-list.action.ts

@@ -44,7 +44,9 @@ export const fetchBackupsAction = userAction
                 restorations: true,
                 storages: {
                     with: {
-                        storageChannel: true,
+                        storageChannel: {
+                            columns: { id: true, name: true, provider: true },
+                        },
                     },
                 },
             },