fix(hub): user alerts idor

fixes very unlikely scenario where user guesses another user's 15
character random system id and adds alerts for it

internal/alerts/alerts_api.go

@@ -9,6 +9,7 @@ import (
 	"slices"
 	"strings"
 
+	"github.com/henrygd/beszel/internal/hub/utils"
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 )
@@ -37,6 +38,9 @@ func UpsertUserAlerts(e *core.RequestEvent) error {
 
 	err = e.App.RunInTransaction(func(txApp core.App) error {
 		for _, systemId := range reqData.Systems {
+			if !userHasSystem(txApp, userID, systemId) {
+				continue
+			}
 			// find existing matching alert
 			alertRecord, err := txApp.FindFirstRecordByFilter(alertsCollection,
 				"system={:system} && name={:name} && user={:user}",
@@ -94,6 +98,9 @@ func DeleteUserAlerts(e *core.RequestEvent) error {
 
 	err = e.App.RunInTransaction(func(txApp core.App) error {
 		for _, systemId := range reqData.Systems {
+			if !userHasSystem(txApp, userID, systemId) {
+				continue
+			}
 			// Find existing alert to delete
 			alertRecord, err := txApp.FindFirstRecordByFilter("alerts",
 				"system={:system} && name={:name} && user={:user}",
@@ -122,6 +129,15 @@ func DeleteUserAlerts(e *core.RequestEvent) error {
 	return e.JSON(http.StatusOK, map[string]any{"success": true, "count": numDeleted})
 }
 
+func userHasSystem(app core.App, userID, systemID string) bool {
+	system, err := app.FindRecordById("systems", systemID)
+	if err != nil {
+		return false
+	}
+	shareAll, _ := utils.GetEnv("SHARE_ALL_SYSTEMS")
+	return shareAll == "true" || slices.Contains(system.GetStringSlice("users"), userID)
+}
+
 // SendTestNotification handles API request to send a test notification to a specified Shoutrrr URL
 func (am *AlertManager) SendTestNotification(e *core.RequestEvent) error {
 	var data struct {

internal/alerts/alerts_api_test.go

@@ -190,6 +190,30 @@ func TestUserAlertsApi(t *testing.T) {
 				assert.EqualValues(t, 3, user1Alerts, "should have 3 alerts")
 			},
 		},
+		{
+			Name:   "POST ignores systems the user cannot access",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user2Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "CPU",
+				"systems": []string{system1.Id},
+				"value":   90,
+				"min":     10,
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.Zero(t, alerts)
+			},
+		},
 		{
 			Name:   "Overwrite: false, should not overwrite existing alert",
 			Method: http.MethodPost,
@@ -347,6 +371,31 @@ func TestUserAlertsApi(t *testing.T) {
 				assert.Zero(t, alerts, "should have 0 alerts")
 			},
 		},
+		{
+			Name:   "DELETE ignores systems the user cannot access",
+			Method: http.MethodDelete,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user2Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"count\":0", "\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "CPU",
+				"systems": []string{system1.Id},
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				beszelTests.CreateRecord(app, "alerts", map[string]any{
+					"name": "CPU", "system": system1.Id, "user": user2.Id, "value": 80,
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 1, alerts)
+			},
+		},
 		{
 			Name:   "User 2 should not be able to delete alert of user 1",
 			Method: http.MethodDelete,