Close an IDOR/privilege escalation in the dashboard playground flow where the mint endpoint accepted an arbitrary caller-supplied user_id and stored it in key metadata, enabling a project member to act as another external Tool Router user.
Description
Add a small helper getInternalPlaygroundUserId (in apps/apollo/src/lib/apiKeys/internal_playground.ts) that derives the canonical playground external user_id as pg-test-{userOrgMappingId}.
Tighten the playground mint endpoint POST /api/internal-dashboard/api-keys/internal-playground (file apps/apollo/src/pages/api/internal-dashboard/api-keys/internal-playground.ts) to resolve the caller's UserOrgMapping, require the supplied user_id to match the derived pg-test-{mappingId} identity, and persist only that derived value in the key metadata.
Harden Tool Router session creation (apps/apollo/src/pages/api/v3/tool_router/session.ts) to re-resolve the creator's UserOrgMapping and fail if either the request body.user_id or the API key metadata.userId do not match the expected pg-test-{mappingId} (rejects stale/tampered keys).
Update focused tests to reflect the new binding and to cover stale/tampered metadata rejection (files updated: internal-playground.test.ts, session_create.test.ts).
Testing
Built the shared library with pnpm --filter @composio/lib bundle which succeeded.
Ran formatting checks with oxfmt on the modified files which succeeded.
Attempted to run the focused Vitest suite for the playground mint tests (apps/apollo), but vitest runs were blocked by missing Doppler/secrets and required environment variables in the local environment so the test run could not complete.
Type-check (pnpm check-types) and lint runs were attempted but were blocked by local generated-client / environment constraints, so full project type/lint verification did not complete in this environment.
@kaavee315checks…codex/fix-playground-keys-user-id-escalation → master5 files · +131 −67review: @sohamganatrareview: @anshugarg15updated 3d ago