fix: harden dashboard security boundaries

cmd/dashboard/controller/server_config_oracle_test.go

@@ -0,0 +1,54 @@
+package controller
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/require"
+
+	"github.com/nezhahq/nezha/model"
+	"github.com/nezhahq/nezha/service/singleton"
+)
+
+func TestGetServerConfigForeignAndUnknownIDsAreIndistinguishable(t *testing.T) {
+	cleanup, _ := setupMCPTest(t)
+	defer cleanup()
+	require.NoError(t, singleton.DB.Create(&model.User{Common: model.Common{ID: 200}, Username: "bob", Role: model.RoleMember}).Error)
+	tok, _ := mkToken(t, 200, []string{model.ScopeServerRead}, nil)
+
+	probe := func(id string) error {
+		c, _ := patRequestCtx(t, tok, 200, http.MethodGet, "/api/v1/server/config/"+id, nil)
+		c.Params = gin.Params{{Key: "id", Value: id}}
+		_, err := getServerConfig(c)
+		return err
+	}
+
+	foreignErr := probe("7")
+	unknownErr := probe("999999")
+	require.Error(t, foreignErr)
+	require.Error(t, unknownErr)
+	require.Equal(t, foreignErr.Error(), unknownErr.Error())
+}
+
+func TestSetServerConfigForeignAndUnknownIDsAreIndistinguishable(t *testing.T) {
+	cleanup, _ := setupMCPTest(t)
+	defer cleanup()
+	require.NoError(t, singleton.DB.Create(&model.User{Common: model.Common{ID: 200}, Username: "bob", Role: model.RoleMember}).Error)
+	tok, _ := mkToken(t, 200, []string{model.ScopeServerWrite}, nil)
+
+	probe := func(id uint64) error {
+		c, _ := patRequestCtx(t, tok, 200, http.MethodPost, "/api/v1/server/config", model.ServerConfigForm{
+			Servers: []uint64{id},
+			Config:  "{}",
+		})
+		_, err := setServerConfig(c)
+		return err
+	}
+
+	foreignErr := probe(7)
+	unknownErr := probe(999999)
+	require.Error(t, foreignErr)
+	require.Error(t, unknownErr)
+	require.Equal(t, foreignErr.Error(), unknownErr.Error())
+}