mirror of
https://github.com/reconurge/flowsint.git
synced 2026-11-08 14:35:41 -06:00
dextmorgn
80ecb58bbb
launch_enricher took payload.sketch_id on trust: any authenticated caller
could dispatch an enricher against a sketch belonging to someone else, and the
worker would write its findings into that sketch.
EnricherService gains get_sketch_for_launch, the same lookup launch_flow has
used since ac485e2c: resolve the sketch, then _check_permission for "update"
on its investigation. No role row means no access, so an unknown sketch 404s
and a viewer or a stranger gets 403, matching the flow route's responses.
The check runs before the graph read, so a denied caller never reaches Neo4j
and never queues a task.
Unlike FlowService's copy, the sketch id is parsed to a UUID first.
SketchRepository.get_by_id binds it as one, so a non-UUID string reached
SQLAlchemy and raised, which would have turned a bad id into a 500 instead of
a denial.
flowsint-api
Installation
- Install Python dependencies:
uv sync
Run
# dev
uv run uvicorn app.main:app --host 0.0.0.0 --port 5001 --reload
# prod
uv run uvicorn app.main:app --host 0.0.0.0 --port 5001