fix: enforce integration ownership on updates

[IgnisDa]

Fixes the cross-tenant IDOR in createOrUpdateUserIntegration described by GHSA-cjxv-jj8g-vfvj.

Summary:

• Validate that an integration belongs to the authenticated user before updating it.
• Reuse the fetched integration model so user_id cannot be reassigned on the update path.
• Add an end-to-end regression test proving another user cannot hijack or overwrite the integration.

Summary by CodeRabbit

• Bug Fixes
  • Strengthened user integration persistence so updates apply only to integrations owned by the authenticated user.
  • Added checks to reject updates when the provided integration ID doesn’t belong to the user, preventing ownership and data changes.
• Tests
  • Added coverage for “User integration authorization” to verify unauthorized integration update attempts fail and leave both users’ integrations unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: bf2f770c-630c-4b5a-ad20-0e93c14efcf6

📥 Commits

Reviewing files that changed from the base of the PR and between ce89f83 and 4cc639e.

📒 Files selected for processing (1)

• tests/src/tests/user.test.ts

---

Walkthrough

Changes

User integration authorization

Layer / File(s)	Summary
Ownership-checked integration persistence crates/services/user/src/integration_operations.rs	Existing integrations are loaded for updates, verified against the requesting user, and saved with the supplied mutable fields.
Authorization regression coverage tests/src/tests/user.test.ts	Adds GraphQL imports and a test confirming another user cannot update an integration and that ownership remains unchanged.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: enforcing integration ownership checks during updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-integration-idor

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/src/tests/user.test.ts`:
- Around line 195-197: Strengthen the assertion in the ownerIntegrations
post-condition to also verify providerSpecifics.sonarrApiKey remains
"owner-secret". Keep the existing id and name checks, ensuring the test
explicitly confirms the owner's secret was not replaced with "attacker-secret".
- Around line 176-184: Reorder the fields in the test input object so
object-literal properties follow ascending line length: place name before
integrationId, while leaving providerSpecifics and all values unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 47878be2-64e3-4ea3-b584-c6b3a0167528

📥 Commits

Reviewing files that changed from the base of the PR and between 3eee8af and ce89f83.

📒 Files selected for processing (2)

• crates/services/user/src/integration_operations.rs
• tests/src/tests/user.test.ts