Ensure device_service_environment_variable get/set/delete only operat…

…e on releases that belong to the device's app Change-type: patch
balena-io · Nov 22, 2024 · 213b2f0 · 213b2f0
1 parent a61d66e
commit 213b2f0
Showing 1 changed file with 42 additions and 21 deletions.
diff --git a/src/models/device.ts b/src/models/device.ts
@@ -2911,7 +2911,19 @@ const getDeviceModel = function (
 				serviceNameOrId: string | number,
 				key: string,
 			): Promise<string | undefined> {
-				const { id: deviceId } = await exports.get(uuidOrId, { $select: 'id' });
+				const deviceOptions = {
+					$select: 'id',
+					$expand: { belongs_to__application: { $select: 'id' } },
+				} as const;
+
+				const {
+					id: deviceId,
+					belongs_to__application: [{ id: appId }],
+				} = (await sdkInstance.models.device.get(
+					uuidOrId,
+					deviceOptions,
+				)) as PineTypedResult<Device, typeof deviceOptions>;
+
 				const [variable] = await pine.get({
 					resource: 'device_service_environment_variable',
 					options: {
@@ -2932,6 +2944,7 @@ const getDeviceModel = function (
 																$expr: {
 																	is: {
 																		service_name: serviceNameOrId,
+																		application: appId,
 																	},
 																},
 															},
@@ -2984,31 +2997,25 @@ const getDeviceModel = function (
 			): Promise<void> {
 				value = String(value);
 
-				let deviceFilter;
-				if (isId(uuidOrId)) {
-					deviceFilter = uuidOrId;
-				} else if (isFullUuid(uuidOrId)) {
-					deviceFilter = {
-						$any: {
-							$alias: 'd',
-							$expr: {
-								d: {
-									uuid: uuidOrId,
-								},
-							},
-						},
-					};
-				} else {
-					const device = await exports.get(uuidOrId, { $select: 'id' });
-					deviceFilter = device.id;
-				}
+				const deviceOptions = {
+					$select: 'id',
+					$expand: { belongs_to__application: { $select: 'id' } },
+				} as const;
+
+				const {
+					id: deviceId,
+					belongs_to__application: [{ id: appId }],
+				} = (await sdkInstance.models.device.get(
+					uuidOrId,
+					deviceOptions,
+				)) as PineTypedResult<Device, typeof deviceOptions>;
 
 				const serviceInstalls = await pine.get({
 					resource: 'service_install',
 					options: {
 						$select: 'id',
 						$filter: {
-							device: deviceFilter,
+							device: deviceId,
 							installs__service:
 								typeof serviceNameOrId === 'number'
 									? serviceNameOrId
@@ -3018,6 +3025,7 @@ const getDeviceModel = function (
 												$expr: {
 													s: {
 														service_name: serviceNameOrId,
+														application: appId,
 													},
 												},
 											},
@@ -3079,7 +3087,19 @@ const getDeviceModel = function (
 				serviceNameOrId: string | number,
 				key: string,
 			): Promise<void> {
-				const { id: deviceId } = await exports.get(uuidOrId, { $select: 'id' });
+				const deviceOptions = {
+					$select: 'id',
+					$expand: { belongs_to__application: { $select: 'id' } },
+				} as const;
+
+				const {
+					id: deviceId,
+					belongs_to__application: [{ id: appId }],
+				} = (await sdkInstance.models.device.get(
+					uuidOrId,
+					deviceOptions,
+				)) as PineTypedResult<Device, typeof deviceOptions>;
+
 				await pine.delete({
 					resource: 'device_service_environment_variable',
 					options: {
@@ -3099,6 +3119,7 @@ const getDeviceModel = function (
 																$expr: {
 																	is: {
 																		service_name: serviceNameOrId,
+																		application: appId,
 																	},
 																},
 															},