Merge commit from fork

* fix(security): restrict rss-feed urls based on authentication

* fix: lint issues

* fix: incrase the limit to 100

packages/api/src/router/widgets/rssFeed.ts

@@ -1,20 +1,30 @@
+import SuperJSON from "superjson";
 import { z } from "zod/v4";
 
+import type { Session } from "@homarr/auth";
+import type { Database } from "@homarr/db";
+import { eq } from "@homarr/db";
+import { items, users } from "@homarr/db/schema";
 import { rssFeedsRequestHandler } from "@homarr/request-handler/rss-feeds";
 
+import type { WidgetComponentProps } from "../../../../widgets/src";
 import { createTRPCRouter, publicProcedure } from "../../trpc";
 
 export const rssFeedRouter = createTRPCRouter({
   getFeeds: publicProcedure
     .input(
       z.object({
-        urls: z.array(z.string()),
+        urls: z.array(z.string()).max(100),
         maximumAmountPosts: z.number(),
       }),
     )
-    .query(async ({ input }) => {
+    .query(async ({ ctx, input }) => {
+      const urls = (await canAccessAllFeedsAsync(ctx.db, ctx.session))
+        ? input.urls
+        : await restrictUrlsAsync(ctx.db, input.urls);
+
       const rssFeeds = await Promise.all(
-        input.urls.map(async (url) => {
+        urls.map(async (url) => {
           const innerHandler = rssFeedsRequestHandler.handler({
             url,
             count: input.maximumAmountPosts,
@@ -35,3 +45,63 @@ export const rssFeedRouter = createTRPCRouter({
         });
     }),
 });
+
+export async function canAccessAllFeedsAsync(db: Database, session: Session | null) {
+  // Unauthenticated users can never access all feeds
+  if (!session) return false;
+  // Users with those permissions can modify a board and therefore add a rss feed widget with any feed url
+  if (session.user.permissions.includes("board-create") || session.user.permissions.includes("board-modify-all")) {
+    return true;
+  }
+
+  const user = await db.query.users.findFirst({
+    where: eq(users.id, session.user.id),
+    with: {
+      boards: {
+        columns: { id: true },
+      },
+      boardPermissions: true,
+      groups: {
+        with: {
+          group: {
+            with: { boardPermissions: true },
+          },
+        },
+      },
+    },
+  });
+
+  // Should never happen as the user is authenticated, but just in case
+  if (!user) return false;
+
+  // If user is owner of any board he has full access and can therefore create widgets with any feed url
+  if (user.boards.length >= 1) return true;
+
+  // If user has direct permissions on any board that allow modifying it, he can add a rss feed widget with any feed url
+  if (user.boardPermissions.some(({ permission }) => permission === "modify" || permission === "full")) {
+    return true;
+  }
+
+  // If user is in a group that has permissions on any board that allow modifying it, he can add a rss feed widget with any feed url
+  if (
+    user.groups.some(({ group }) =>
+      group.boardPermissions.some(({ permission }) => permission === "modify" || permission === "full"),
+    )
+  ) {
+    return true;
+  }
+
+  // Fallback to not allowing access to all feeds
+  return false;
+}
+
+export async function restrictUrlsAsync(db: Database, urls: string[]) {
+  const rssFeedItems = await db.query.items.findMany({
+    where: eq(items.kind, "rssFeed"),
+  });
+
+  const configuredUrls = rssFeedItems
+    .map((item) => SuperJSON.parse<WidgetComponentProps<"rssFeed">["options"]>(item.options))
+    .flatMap((options) => options.feedUrls);
+  return urls.filter((url) => configuredUrls.includes(url));
+}