fix(controller): filter listing endpoints by ownership

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>

cmd/dashboard/controller/notification_group.go

@@ -39,8 +39,12 @@ func listNotificationGroup(c *gin.Context) ([]*model.NotificationGroupResponseIt
 		groupNotifications[n.NotificationGroupID] = append(groupNotifications[n.NotificationGroupID], n.NotificationID)
 	}
 
+	isAdmin := callerIsAdmin(c)
 	ngRes := make([]*model.NotificationGroupResponseItem, 0, len(ng))
 	for _, n := range ng {
+		if !isAdmin && !n.HasPermission(c) {
+			continue
+		}
 		ngRes = append(ngRes, &model.NotificationGroupResponseItem{
 			Group:         n,
 			Notifications: groupNotifications[n.ID],

cmd/dashboard/controller/server_group.go

@@ -27,10 +27,10 @@ func listServerGroup(c *gin.Context) ([]*model.ServerGroupResponseItem, error) {
 	}
 
 	_, isMember := c.Get(model.CtxKeyAuthorizedUser)
-	authorized := isMember
+	isAdmin := isMember && callerIsAdmin(c)
 
 	visibleServerIDs := make(map[uint64]struct{})
-	if !authorized {
+	if !isMember {
 		for _, server := range singleton.ServerShared.GetSortedListForGuest() {
 			visibleServerIDs[server.ID] = struct{}{}
 		}
@@ -42,7 +42,7 @@ func listServerGroup(c *gin.Context) ([]*model.ServerGroupResponseItem, error) {
 		return nil, err
 	}
 	for _, s := range sgs {
-		if !authorized {
+		if !isMember {
 			if _, ok := visibleServerIDs[s.ServerId]; !ok {
 				continue
 			}
@@ -55,6 +55,9 @@ func listServerGroup(c *gin.Context) ([]*model.ServerGroupResponseItem, error) {
 
 	var sgRes []*model.ServerGroupResponseItem
 	for _, s := range sg {
+		if isMember && !isAdmin && !s.HasPermission(c) {
+			continue
+		}
 		sgRes = append(sgRes, &model.ServerGroupResponseItem{
 			Group:   s,
 			Servers: groupServers[s.ID],