Dokploy / Dokploy/dokploy

compose.search omits services missing from member accessedServices, even for owners/admins

Open Beginner friendly
#5,361 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
37.4k
Forks
3k
Avg merge
1d 3h
Merged PRs (30d)
73

Description

Problem

GET /api/compose.search returns an incomplete list: on our instance it reports total: 13 while project.one nesting across all projects shows 20 composes. The 7 missing composes are all reachable via compose.one.

Root cause

In apps/dokploy/server/api/routers/compose.ts, the search procedure unconditionally restricts results to:

sql`${composeTable.composeId} IN (...accessedServices...)`

using the calling member's accessedServices list. Unlike one / checkServiceAccess (via packages/server/src/services/permission.ts), search does not exempt owner/admin roles from this filter.

Services only land in a member's accessedServices via addNewService() at creation time, for the creating user. Any service created by another user, imported, or predating the entry is invisible to search for everyone else — including owners and the API key holder — while remaining fully visible in the dashboard (which renders from project.one nesting) and via compose.one.

Expected

search should apply the same owner/admin exemption as one, so owners and admins get the complete list.

Repro

  1. As user A (owner), create several compose services.
  2. As user B (owner, or an API key owned by B), call compose.search — services created by A are missing (total short), but compose.one returns each of them and the dashboard shows all of them.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in apps/dokploy/server/api/routers/compose.ts at the search procedure, then compare its access logic with one/checkServiceAccess in packages/server/src/services/permission.ts. Ensure owner and admin searches include services missing from accessedServices, and verify the repro where compose.search matches the complete list returned by compose.one.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, authorization, backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
82/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.