[WEB-8332] fix(security): block workspace-member mass-assignment - #9460

Summary

CRITICAL — fixes a cross-tenant workspace takeover (WEB-8332). Confirmed-vulnerable on origin/preview.

WorkSpaceMemberViewSet.partial_update passed request.data straight into WorkSpaceMemberSerializer (fields = "__all__", only nested member read-only). workspace, role, and is_active were therefore mass-assignable. An admin of an attacker-owned workspace could PATCH a member row setting workspace=victim-workspace UUID and role=20 → relocate a controlled account into the victim workspace as an admin with no invitation. Since all authorization derives from WorkspaceMember(workspace, member, role, is_active) rows, this is a full cross-tenant takeover. @allow_permission([ADMIN], level="WORKSPACE") authorizes against the URL slug but does not stop the write from moving the row elsewhere.

Fix

The endpoint's only legitimate mutation is role, so the writable payload is restricted to {"role": ...} in the view:

allowed_data = {}
if "role" in request.data:
    allowed_data["role"] = request.data.get("role")
serializer = WorkSpaceMemberSerializer(workspace_member, data=allowed_data, partial=True)

Why not fields=("id","member","role")? DynamicBaseSerializer.__init__ pops the fields= kwarg and immediately overwrites it with self.expand (serializers/base.py), so fields= never restricts writes or output. The view-level allowlist is the reliable fix and is the only write path through this serializer (list/retrieve are read-only), so no other consumer is affected. The self-role-update guard and guest role-cascade are preserved; is_active is only changed via destroy().

Tests

New tests/contract/app/test_workspace_member_mass_assignment_app.py — 4 cases (cross-workspace move blocked; is_active=false no-ops; legitimate role update works; self-update still 400). Fail-before verified on the CE docker test stack: 2 attack tests failed unpatched → 4 pass patched; 12/12 in a regression run with sibling member/authz suites.

Related finding (separate ticket — NOT in this PR)

The root cause exposed a latent bug: DynamicBaseSerializer's fields= kwarg is discarded (base.py: fields = self.expand), so every caller that passes fields=(...) expecting to limit output (e.g. list/retrieve here) actually returns all model columns. That's an app-wide over-disclosure surface needing its own scoped audit + FE-compat check — filed separately; deliberately not touched here (changing base.py would enforce output filtering app-wide and likely break the frontend).

Summary by CodeRabbit

• Bug Fixes

  • Workspace member updates now accept only a role change; requests without a role leave the member unchanged.
  • Invalid role values return a client error without changing workspace or project roles.
  • Setting a member’s role to guest also updates their project roles.

• Tests

  • Added coverage for ignored extra fields, role updates, self-role restrictions, and invalid role values.