Update webhook security docs and error handling

[osama1998H]

Summary

• route webhook create/update requests through WebhookService so URL validation and delivery safeguards are enforced consistently
• return 400 for ErrInvalidInput and document unsafe webhook URL rejection in Swagger output
• update the security report to mark the webhook SSRF finding as fixed and reflect the new validation/test status

Testing

• Not run (not requested)

Summary by CodeRabbit

• Bug Fixes

  • Fixed a tenant isolation vulnerability in role assignments. Users can no longer be assigned roles outside their organization, and legacy cross-organization assignments are automatically cleaned up.

• Documentation

  • Updated security report documenting remediation of the tenant isolation finding.

• Tests

  • Enhanced test coverage for multi-tenant role assignment integrity.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: dcb4c6df-6b80-44c9-91e8-a977a328c11e

📥 Commits

Reviewing files that changed from the base of the PR and between 7590d6d and ae18151.

📒 Files selected for processing (6)

• docs/security-report.md
• internal/repository/postgres/roles.go
• internal/repository/postgres/tenant_scope_test.go
• internal/service/rbac.go
• migrations/000002_user_roles_org_scope.down.sql
• migrations/000002_user_roles_org_scope.up.sql

---

📝 Walkthrough

Walkthrough

This PR implements tenant-scoped role assignments by adding org_id tracking to the user_roles table. It updates the repository layer to persist and validate organization context during role assignments, adds comprehensive test coverage for tenant integrity constraints, updates the service layer callsite, and includes forward/backward database migrations to enforce composite foreign keys that prevent cross-tenant role assignments.

Changes

Cohort / File(s)	Summary
User Roles Org Scoping Migrations migrations/000002_user_roles_org_scope.up.sql, migrations/000002_user_roles_org_scope.down.sql	Forward migration adds composite uniqueness constraints on users (id, org_id) and roles (id, org_id), introduces org_id column to user_roles, reconciles existing cross-org rows by deletion, and replaces single-column FKs with composite ones referencing (id, org_id). Backward migration reverses these changes.
Repository & Tenant Integrity internal/repository/postgres/roles.go, internal/repository/postgres/tenant_scope_test.go	AssignRoleToUser now accepts orgID parameter and persists it to the database; added error mapping to convert PostgreSQL FK violations (code 23503) to domain.ErrNotFound. New TestStoreUserRoleTenantIntegrity validates same-org assignments succeed, foreign-org user/role assignments are rejected, and raw FK violations are caught.
Service Layer Integration internal/service/rbac.go	Updated RBACService.AssignRoleToUser to pass orgID as first argument to the repository layer's AssignRoleToUser call.
Documentation docs/security-report.md	Updated security findings status for finding 4 from open to Fixed; adjusted remediation roadmap to include legacy cross-tenant link removal; expanded verification checklist to reference tenant_scope_test.go; updated summary counts and narrative dates.

Sequence Diagram

sequenceDiagram
    actor Client
    participant Service as RBACService
    participant Repo as Repository<br/>(roles.go)
    participant DB as PostgreSQL
    
    Client->>Service: AssignRoleToUser(ctx, orgID, userID, roleID)
    Service->>Service: Validate user exists in orgID
    Service->>Service: Validate role exists in orgID
    Service->>Repo: AssignRoleToUser(ctx, orgID, userID, roleID)
    Repo->>DB: INSERT INTO user_roles<br/>(user_id, role_id, org_id)
    alt Same-org assignment
        DB-->>DB: Composite FK check:<br/>(user_id, org_id) → users<br/>(role_id, org_id) → roles
        DB-->>Repo: Success
        Repo-->>Service: nil
        Service-->>Client: Success + Audit log
    else Cross-org assignment
        DB-->>DB: FK violation (code 23503)
        DB-->>Repo: PgError
        Repo-->>Repo: Map to ErrNotFound
        Repo-->>Service: ErrNotFound
        Service-->>Client: Error
    end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• Fix tenant scoping for user and role access #13: Modifies the same RBAC/tenant-scoping code paths—changes AssignRoleToUser signature to include orgID, adds tenant-integrity tests validating cross-org rejection via ErrNotFound and PG 23503, and adjusts user_roles schema constraints.

Poem

🐰 With org_id's careful gate,
Cross-tenant roles meet their fate!
Migrations mend what once was loose,
Each burrow safe—no more excuse! 🔐

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-security-report-item

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}