This pull request strengthens site-level access control for target creation and updating by ensuring that users can only act on sites they are authorized to access. It introduces a new helper function to centralize site access logic and applies this check consistently in both the target creation and update flows.
Access control improvements:
Added a new helper function canUserAccessSite in server/auth/canUserAccessSite.ts to encapsulate logic for determining if a user or their roles grant access to a specific site.
Integrated the canUserAccessSite check into both createTarget and updateTarget endpoints to ensure that, for user-initiated requests, the user has explicit access to the site before proceeding. [1][2]
Added an additional check to both endpoints to verify that the site belongs to the same organization as the resource, preventing cross-organization access. [1][2]
Codebase consistency:
Imported the new canUserAccessSite helper in both server/routers/target/createTarget.ts and server/routers/target/updateTarget.ts to support the new access control logic. [1][2]
Note
PR Description generated by Copilot
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/fosrl/pangolin/pull/3190
**Author:** [@marcschaeferger](https://github.com/marcschaeferger)
**Created:** 5/29/2026
**Status:** ❌ Closed
**Base:** `main` ← **Head:** `main`
---
### 📝 Commits (1)
- [`fa2f2ab`](https://github.com/fosrl/pangolin/commit/fa2f2ab4d02476d54b794c4abcbebb9820c8aadb) fix(auth): add site authorization checks to target create and update handlers
### 📊 Changes
**3 files changed** (+98 additions, -0 deletions)
<details>
<summary>View changed files</summary>
➕ `server/auth/canUserAccessSite.ts` (+42 -0)
📝 `server/routers/target/createTarget.ts` (+28 -0)
📝 `server/routers/target/updateTarget.ts` (+28 -0)
</details>
### 📄 Description
This pull request strengthens site-level access control for target creation and updating by ensuring that users can only act on sites they are authorized to access. It introduces a new helper function to centralize site access logic and applies this check consistently in both the target creation and update flows.
**Access control improvements:**
* Added a new helper function `canUserAccessSite` in `server/auth/canUserAccessSite.ts` to encapsulate logic for determining if a user or their roles grant access to a specific site.
* Integrated the `canUserAccessSite` check into both `createTarget` and `updateTarget` endpoints to ensure that, for user-initiated requests, the user has explicit access to the site before proceeding. [[1]](diffhunk://#diff-6bf7e0c67e1b73ded23ead1ea16fa773c834dcdd1b31dc444e7cbc464c6bdecaR150-R176) [[2]](diffhunk://#diff-9058469b293a7f20d3a07a7ee40d1b39f70d883f8563689315218f06b7236984R161-R187)
* Added an additional check to both endpoints to verify that the site belongs to the same organization as the resource, preventing cross-organization access. [[1]](diffhunk://#diff-6bf7e0c67e1b73ded23ead1ea16fa773c834dcdd1b31dc444e7cbc464c6bdecaR150-R176) [[2]](diffhunk://#diff-9058469b293a7f20d3a07a7ee40d1b39f70d883f8563689315218f06b7236984R161-R187)
**Codebase consistency:**
* Imported the new `canUserAccessSite` helper in both `server/routers/target/createTarget.ts` and `server/routers/target/updateTarget.ts` to support the new access control logic. [[1]](diffhunk://#diff-6bf7e0c67e1b73ded23ead1ea16fa773c834dcdd1b31dc444e7cbc464c6bdecaR21) [[2]](diffhunk://#diff-9058469b293a7f20d3a07a7ee40d1b39f70d883f8563689315218f06b7236984R21)
# Note
PR Description generated by Copilot
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/pangolin/pull/3190
Author: @marcschaeferger
Created: 5/29/2026
Status: ❌ Closed
Base:
main← Head:main📝 Commits (1)
fa2f2abfix(auth): add site authorization checks to target create and update handlers📊 Changes
3 files changed (+98 additions, -0 deletions)
View changed files
➕
server/auth/canUserAccessSite.ts(+42 -0)📝
server/routers/target/createTarget.ts(+28 -0)📝
server/routers/target/updateTarget.ts(+28 -0)📄 Description
This pull request strengthens site-level access control for target creation and updating by ensuring that users can only act on sites they are authorized to access. It introduces a new helper function to centralize site access logic and applies this check consistently in both the target creation and update flows.
Access control improvements:
canUserAccessSiteinserver/auth/canUserAccessSite.tsto encapsulate logic for determining if a user or their roles grant access to a specific site.canUserAccessSitecheck into bothcreateTargetandupdateTargetendpoints to ensure that, for user-initiated requests, the user has explicit access to the site before proceeding. [1] [2]Codebase consistency:
canUserAccessSitehelper in bothserver/routers/target/createTarget.tsandserver/routers/target/updateTarget.tsto support the new access control logic. [1] [2]Note
PR Description generated by Copilot
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.