Merge commit from fork

* fix(security): restrict access to integrations to authenticated users

* chore: github is broken

apps/nextjs/src/components/board/items/item-menu.tsx

@@ -14,16 +14,22 @@ import type { SectionItem } from "~/app/[locale]/boards/_types";
 import { useSectionContext } from "../sections/section-context";
 import { useItemActions } from "./item-actions";
 import { ItemMoveModal } from "./item-move-modal";
+import { useSession } from "@homarr/auth/client";
 
-export const BoardItemMenu = ({
-  offset,
-  item,
-  resetErrorBoundary,
-}: {
-  offset: number;
+interface BoardItemMenuProps {
+ offset: number;
   item: SectionItem;
   resetErrorBoundary?: () => void;
-}) => {
+}
+
+export const BoardItemMenu = (props: BoardItemMenuProps) => {
+  const {data: session} = useSession();
+  if (!session) return null;
+
+  return <BoardItemMenuInner {...props} />;
+};
+
+const BoardItemMenuInner = ({ offset, item, resetErrorBoundary }: BoardItemMenuProps) => {
   const refResetErrorBoundaryOnNextRender = useRef(false);
   const tItem = useScopedI18n("item");
   const t = useI18n();
@@ -130,4 +136,4 @@ export const BoardItemMenu = ({
       </Menu.Dropdown>
     </Menu>
   );
-};
+}

packages/api/src/router/integration/integration-router.ts

@@ -43,7 +43,7 @@ import { mapTestConnectionError } from "./map-test-connection-error";
 const logger = createLogger({ module: "integrationRouter" });
 
 export const integrationRouter = createTRPCRouter({
-  all: publicProcedure.query(async ({ ctx }) => {
+  all: protectedProcedure.query(async ({ ctx }) => {
     const groupsOfCurrentUser = await ctx.db.query.groupMembers.findMany({
       where: eq(groupMembers.userId, ctx.session?.user.id ?? ""),
     });
@@ -85,7 +85,7 @@ export const integrationRouter = createTRPCRouter({
           integrationKinds.indexOf(integrationA.kind) - integrationKinds.indexOf(integrationB.kind),
       );
   }),
-  allThatSupportSearch: publicProcedure.query(async ({ ctx }) => {
+  allThatSupportSearch: protectedProcedure.query(async ({ ctx }) => {
     const groupsOfCurrentUser = await ctx.db.query.groupMembers.findMany({
       where: eq(groupMembers.userId, ctx.session?.user.id ?? ""),
     });
@@ -133,7 +133,7 @@ export const integrationRouter = createTRPCRouter({
           integrationKinds.indexOf(integrationA.kind) - integrationKinds.indexOf(integrationB.kind),
       );
   }),
-  allOfGivenCategory: publicProcedure
+  allOfGivenCategory: protectedProcedure
     .input(
       z.object({
         category: z.enum(integrationCategories),