misc: security hardening for pam credential fetch

backend/src/ee/services/pam-account/pam-account-service.ts

@@ -490,6 +490,12 @@ export const pamAccountServiceFactory = ({
     const resource = await pamResourceDAL.findById(account.resourceId);
     if (!resource) throw new NotFoundError({ message: `Resource with ID '${account.resourceId}' not found` });
 
+    if (resource.gatewayIdentityId !== actor.id) {
+      throw new ForbiddenRequestError({
+        message: "Identity does not have access to fetch the PAM session credentials"
+      });
+    }
+
     const decryptedAccount = await decryptAccount(account, session.projectId, kmsService);
 
     const decryptedResource = await decryptResource(resource, session.projectId, kmsService);

backend/src/ee/services/pam-resource/pam-resource-dal.ts

@@ -1,9 +1,24 @@
+import { Knex } from "knex";
+
 import { TDbClient } from "@app/db";
 import { TableName } from "@app/db/schemas";
-import { ormify } from "@app/lib/knex";
+import { ormify, selectAllTableCols } from "@app/lib/knex";
 
 export type TPamResourceDALFactory = ReturnType<typeof pamResourceDALFactory>;
 export const pamResourceDALFactory = (db: TDbClient) => {
   const orm = ormify(db, TableName.PamResource);
-  return { ...orm };
+
+  const findById = async (id: string, tx?: Knex) => {
+    const doc = await (tx || db.replicaNode())(TableName.PamResource)
+      .join(TableName.GatewayV2, `${TableName.PamResource}.gatewayId`, `${TableName.GatewayV2}.id`)
+      .select(selectAllTableCols(TableName.PamResource))
+      .select(db.ref("name").withSchema(TableName.GatewayV2).as("gatewayName"))
+      .select(db.ref("identityId").withSchema(TableName.GatewayV2).as("gatewayIdentityId"))
+      .where(`${TableName.PamResource}.id`, id)
+      .first();
+
+    return doc;
+  };
+
+  return { ...orm, findById };
 };