Merge commit from fork

* fix(security): resolve ssrf issue with simple ping

* refactor: improve testability of app-access-control and fix tests

* fix: unnecessary space

Co-authored-by: ajnart <thomas@ajnart.fr>

---------

Co-authored-by: ajnart <thomas@ajnart.fr>

packages/api/src/router/app/app-access-control.ts

@@ -1,45 +1,52 @@
 import SuperJSON from "superjson";
 
 import type { Session } from "@homarr/auth";
-import { db, eq, or } from "@homarr/db";
+import type { Database } from "@homarr/db";
+import { eq, or } from "@homarr/db";
 import { items } from "@homarr/db/schema";
 
 import type { WidgetComponentProps } from "../../../../widgets/src";
 
-export const canUserSeeAppAsync = async (user: Session["user"] | null, appId: string) => {
-  return await canUserSeeAppsAsync(user, [appId]);
-};
+export class AppAccessControl {
+  constructor(
+    private db: Database,
+    private user: Session["user"] | null,
+  ) {}
 
-export const canUserSeeAppsAsync = async (user: Session["user"] | null, appIds: string[]) => {
-  if (user) return true;
+  async canUserSeeAppAsync(appId: string) {
+    return await this.canUserSeeAppsAsync([appId]);
+  }
 
-  const appIdsOnPublicBoards = await getAllAppIdsOnPublicBoardsAsync();
-  return appIds.every((appId) => appIdsOnPublicBoards.includes(appId));
-};
+  async canUserSeeAppsAsync(appIds: string[]) {
+    // Currently any user can see all apps if they are logged in
+    if (this.user) return true;
 
-const getAllAppIdsOnPublicBoardsAsync = async () => {
-  const itemsWithApps = await db.query.items.findMany({
-    where: or(eq(items.kind, "app"), eq(items.kind, "bookmarks")),
-    with: {
-      board: {
-        columns: {
-          isPublic: true,
+    const appIdsOnPublicBoards = await this.getAllAppIdsOnPublicBoardsAsync();
+    return appIds.every((appId) => appIdsOnPublicBoards.includes(appId));
+  }
+
+  private async getAllAppIdsOnPublicBoardsAsync() {
+    const itemsWithApps = await this.db.query.items.findMany({
+      where: or(eq(items.kind, "app"), eq(items.kind, "bookmarks")),
+      with: {
+        board: {
+          columns: {
+            isPublic: true,
+          },
         },
       },
-    },
-  });
+    });
+
+    return itemsWithApps
+      .filter((item) => item.board.isPublic)
+      .flatMap((item) => {
+        if (item.kind === "app") {
+          const parsedOptions = SuperJSON.parse<WidgetComponentProps<"app">["options"]>(item.options);
+          return [parsedOptions.appId];
+        }
 
-  return itemsWithApps
-    .filter((item) => item.board.isPublic)
-    .flatMap((item) => {
-      if (item.kind === "app") {
-        const parsedOptions = SuperJSON.parse<WidgetComponentProps<"app">["options"]>(item.options);
-        return [parsedOptions.appId];
-      } else if (item.kind === "bookmarks") {
         const parsedOptions = SuperJSON.parse<WidgetComponentProps<"bookmarks">["options"]>(item.options);
         return parsedOptions.items;
-      }
-
-      throw new Error("Failed to get app ids from board. Invalid item kind: 'test'");
-    });
-};
+      });
+  }
+}