Put the Workspace Check Inside the Database Write
A record can belong to workspace Alpha when you check it and workspace Beta when you update it. If the UPDATE filters only by record ID, the earlier check no longer protects the write. In the comments on the previous MCP permissions example , arun pointed out this database boundary . That example used an in-memory map. Moving the handler to a database needs one more decision: which rows is the…
SQLite offers a way to enforce workspace boundaries in database operations. When a record can belong to different workspaces, checking the workspace at the time of update is crucial to prevent unintended writes. The provided example demonstrates this using SQLite and Python.
A sequence of steps shows a record being transferred from one workspace to another, then updated. The update statement lacks a condition to check the workspace, leading to the update of the record in the new workspace. By adding a workspace_id condition to the UPDATE statement, the code ensures that only rows from the correct workspace are updated.
The provided code defines a function to safely update the interval of automations, taking into account the principal's workspace_id and the validation of the interval. The function uses SQLite's RETURNING clause to fetch the updated row and checks if a row was actually updated. The tests confirm that the workspace is correctly enforced in the mutation.
This approach allows for a more secure and accurate database operation, ensuring that updates are made only to the correct workspace's records.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
