fix(security): prevent IDOR in updateWrongAssignmentReportStatus with team membership check (#29957)

[jihadMo]

Closes #29957

Summary of Changes

• Adds an explicit team membership verification check (prisma.membership.findFirst({ where: { userId: user.id, teamId: report.teamId, accepted: true } })) in packages/trpc/server/routers/viewer/bookings/updateWrongAssignmentReportStatus.handler.ts.
• Throws TRPCError with code FORBIDDEN if the caller is not an accepted member of the team associated with the wrong-assignment report.
• Resolves IDOR vulnerability that previously allowed any authenticated user to update or dismiss reports for arbitrary teams.

Verification

• Verified that missing reports return NOT_FOUND.
• Verified that unauthorized callers attempting to update reports for foreign teams receive FORBIDDEN.
• Verified that valid team members can successfully update status.

[github-actions]

Welcome to Cal.diy, @jihadMo! Thanks for opening this pull request.

A few things to keep in mind:

• This is Cal.diy, not Cal.com. Cal.diy is a community-driven, fully open-source fork of Cal.com licensed under MIT. Your changes here will be part of Cal.diy — they will not be deployed to the Cal.com production app.
• Please review our Contributing Guidelines if you haven't already.
• Make sure your PR title follows the Conventional Commits format.

A maintainer will review your PR soon. Thanks for contributing!

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ab37c7a0-0fa0-4bcd-a3d9-4d4eaafb5bd8

📥 Commits

Reviewing files that changed from the base of the PR and between 176037d and 8977359.

📒 Files selected for processing (1)

• packages/trpc/server/routers/viewer/bookings/updateWrongAssignmentReportStatus.handler.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

The report status handler now verifies that the requesting user has an accepted membership in the report’s team. Users without membership receive a FORBIDDEN error. Missing reports continue to receive a NOT_FOUND error.

Merge Risk: ⚪ Minimal · up to 89773

The change restricts wrong-assignment report updates to accepted team members and returns the appropriate authorization error for foreign-team access. No actionable merge-blocking risk remains based on the supplied evidence.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the security fix and the accepted team-membership check that prevents the IDOR vulnerability.
Description check	✅ Passed	The description accurately explains the membership check, error behavior, vulnerability, and verification results.
Linked Issues check	✅ Passed	The change satisfies issue #29957 by checking accepted membership and returning FORBIDDEN while preserving NOT_FOUND behavior.
Out of Scope Changes check	✅ Passed	The changes are limited to securing updateWrongAssignmentReportStatus and align with the linked issue objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[CLAassistant]

All committers have signed the CLA.