ResourceKind

Kind: Type

Source: atloria-monorepo/apps/api/src/auth/guards/resource-org.guard.ts

ResourceOrgGuard — generalized cross-tenant ownership enforcement.

WHY: OrganizationGuard only validates an EXPLICIT organizationId present in the request and no-ops otherwise, so any route scoped only by a child id (:projectId, :versionId, :documentId, :id, …) sails past it. A security audit found this hole recurs across ~16 controllers / 100+ routes, letting any authenticated user read, mutate, or DESTROY another tenant's data (e.g. DELETE a foreign doc-version and cascade-delete every document in it). ProjectOrgGuard closed it for :projectId; this guard generalizes that to every id type by resolving the resource → its owning organization and comparing to the caller's.

USAGE (declarative — annotate the route or controller):

Definition

ts
| 'project'
  | 'document'
  | 'docVersion'
  | 'documentationJob'
  | 'supportAgentConfig'
  | 'comment'
  | 'suggestion'
  | 'pmeJob'
  | 'pmePage'
  | 'pmeVariant'
  | 'changeRequest'
  | 'scheduledReport'