Security multi-company association - mysql

Question

Problem: a company can associate records that are not theirs, just by informing the id in the relationship
Scenario: My api is multi-company and each company manage your records (products, orders...), but these companies can only view and use records that belong to them. However, it is possible to enter an id of a product of another company in an order and should not
Example: The Apple company can only inform the iPhone product in its orders, if it tried to inform the Google Pixel should have some error message
Observations: I hope I do not need to validate each record associated with the order before saving because my actual schema has multiple relationships (20 tables associated with a order, some 2 level cascade) and this is only small example. It would be very complicated to search the database for each product and verify that it belongs to the company. I think it would be possible to prevent this recording with some index setting
Question: How can I prevent associating records from other companies with current company records, even reporting the id on body request?
I would appreciate your help, since I have a system in production with this situation.
company.entity.ts
#Entity()
export class Company {
#PrimaryGeneratedColumn()
id: number;
#Column()
name: string;
#OneToMany(() => Product, (product) => product.company)
products: Product[];
#OneToMany(() => Order, (order) => order.company)
orders: Order[];
}
product.entity.ts
#Entity()
export class Product {
#PrimaryGeneratedColumn()
id: number;
#Column()
description: string;
#ManyToOne(() => Company, (company) => company.products)
company: Company;
}
order.entity.ts
#Entity()
export class Order {
#PrimaryGeneratedColumn()
id: number;
#Column()
description: string;
#ManyToOne(() => Company, (company) => company.orders)
company: Company;
#ManyToMany(() => Product)
#JoinTable()
products: Product[];
}
order.controller.ts
#Controller('orders')
export class OrderController {
constructor(
#InjectRepository(Order)
public repository: Repository<Order>,
) { }
#Post()
public async create(#Body() body: Order): Promise<Order> {
body.id = undefined;
body = await this.repository.save(body);
return await this.repository.findOne(body.id, { relations: ['products'] });
}
#Put(':id')
public async update(#Param('id') id, #Body() body: Order): Promise<Order> {
body.id = Number(id);
await this.repository.save(body);
return await this.repository.findOne(id, { relations: ['products'] });
}
}
Company table
id: 1 description: Apple
id: 2 description: Google
Item table
id: 1 description: iPhone companyId: 1
id: 2 description: Google Pixel companyId: 2
POST http://localhost:3040/orders
Body Request:
Obs.: here the user informs the iPhone which is a product that he knows, and forces the product id 2 being an unknown product, because api GET validate which products are visible to Apple, in this case only the iPhone
{
"company": 1,
"description": "Order 001",
"products": [
{
"id": 1,
"description": "iPhone"
},
{
"id": 2
}
]
}
Body Response:
Obs.: even informing the product of another company, on the return of the api is presented the Google Pixel that could not be recorded at Apple's order. Here you should have an error message
{
"id": 2,
"description": "Order 001",
"products": [
{
"id": 1,
"description": "iPhone"
},
{
"id": 2,
"description": "Google Pixel"
}
]
}
Result Tables
Order table
id: 1 description: Order 001 companyId: 1
Order Product table
orderId: 2 productId: 1
orderId: 2 productId: 2

Answer 1

There are two issues to solve. The first is that the many-to-many relationship between order and product does not limit the product's company. You can probably do that using the right decorators, I believe you can specify table and column information in your #JoinTable decorator.
The second issue is there needs to be a way to associate API caller with the company they belong to. You can do this by using a JWT for authentication and embed the company id in the JWT's payload.
Hope this helps.