fix(hub): user alerts idor

fixes very unlikely scenario where user guesses another user's 15
character random system id and adds alerts for it

internal/alerts/alerts_api.go

@@ -9,6 +9,7 @@ import (
 	"slices"
 	"strings"
 
+	"github.com/henrygd/beszel/internal/hub/utils"
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 )
@@ -37,6 +38,9 @@ func UpsertUserAlerts(e *core.RequestEvent) error {
 
 	err = e.App.RunInTransaction(func(txApp core.App) error {
 		for _, systemId := range reqData.Systems {
+			if !userHasSystem(txApp, userID, systemId) {
+				continue
+			}
 			// find existing matching alert
 			alertRecord, err := txApp.FindFirstRecordByFilter(alertsCollection,
 				"system={:system} && name={:name} && user={:user}",
@@ -94,6 +98,9 @@ func DeleteUserAlerts(e *core.RequestEvent) error {
 
 	err = e.App.RunInTransaction(func(txApp core.App) error {
 		for _, systemId := range reqData.Systems {
+			if !userHasSystem(txApp, userID, systemId) {
+				continue
+			}
 			// Find existing alert to delete
 			alertRecord, err := txApp.FindFirstRecordByFilter("alerts",
 				"system={:system} && name={:name} && user={:user}",
@@ -122,6 +129,15 @@ func DeleteUserAlerts(e *core.RequestEvent) error {
 	return e.JSON(http.StatusOK, map[string]any{"success": true, "count": numDeleted})
 }
 
+func userHasSystem(app core.App, userID, systemID string) bool {
+	system, err := app.FindRecordById("systems", systemID)
+	if err != nil {
+		return false
+	}
+	shareAll, _ := utils.GetEnv("SHARE_ALL_SYSTEMS")
+	return shareAll == "true" || slices.Contains(system.GetStringSlice("users"), userID)
+}
+
 // SendTestNotification handles API request to send a test notification to a specified Shoutrrr URL
 func (am *AlertManager) SendTestNotification(e *core.RequestEvent) error {
 	var data struct {