compose.search omits services missing from member accessedServices, even for owners/admins
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 37.4k
- Forks
- 3k
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 73
Description
Problem
GET /api/compose.search returns an incomplete list: on our instance it reports total: 13 while project.one nesting across all projects shows 20 composes. The 7 missing composes are all reachable via compose.one.
Root cause
In apps/dokploy/server/api/routers/compose.ts, the search procedure unconditionally restricts results to:
sql`${composeTable.composeId} IN (...accessedServices...)`
using the calling member's accessedServices list. Unlike one / checkServiceAccess (via packages/server/src/services/permission.ts), search does not exempt owner/admin roles from this filter.
Services only land in a member's accessedServices via addNewService() at creation time, for the creating user. Any service created by another user, imported, or predating the entry is invisible to search for everyone else — including owners and the API key holder — while remaining fully visible in the dashboard (which renders from project.one nesting) and via compose.one.
Expected
search should apply the same owner/admin exemption as one, so owners and admins get the complete list.
Repro
- As user A (owner), create several compose services.
- As user B (owner, or an API key owned by B), call
compose.search— services created by A are missing (totalshort), butcompose.onereturns each of them and the dashboard shows all of them.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in apps/dokploy/server/api/routers/compose.ts at the search procedure, then compare its access logic with one/checkServiceAccess in packages/server/src/services/permission.ts. Ensure owner and admin searches include services missing from accessedServices, and verify the repro where compose.search matches the complete list returned by compose.one.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, authorization, backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 82/100