From a7f3133a5bba90940423642080f80b29937611ca Mon Sep 17 00:00:00 2001 From: Graham McIntie Date: Sat, 14 Mar 2026 14:57:40 -0500 Subject: [PATCH] fix: scope agent token deletion to organization (IDOR) --- lib/towerops_web/live/agent_live/index.ex | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/towerops_web/live/agent_live/index.ex b/lib/towerops_web/live/agent_live/index.ex index 96986972..cc44a7e1 100644 --- a/lib/towerops_web/live/agent_live/index.ex +++ b/lib/towerops_web/live/agent_live/index.ex @@ -166,7 +166,11 @@ defmodule ToweropsWeb.AgentLive.Index do # Verify the agent token belongs to the current org before deleting agent_token = Agents.get_agent_token!(id) - if agent_token.organization_id != organization.id do + is_superuser = Scope.superuser?(socket.assigns.current_scope) + is_cloud_poller = is_nil(agent_token.organization_id) + belongs_to_org = agent_token.organization_id == organization.id + + if not belongs_to_org and not (is_superuser and is_cloud_poller) do {:noreply, put_flash(socket, :error, t_equipment("Agent not found"))} else case Agents.delete_agent_token(id) do