fix: takedownJob looks up domain without orgId filter — cross-org job exploit if Trigger.dev dispatch is reachable

[walidboulanouar]

Problem

packages/jobs/src/takedown.ts:113–119 fetches the domain using only domain_id (no orgId filter):

const domain = await db.query.domains.findFirst({
  where: eq(schema.domains.id, payload.domain_id)  // no orgId!
})

The org is then derived from the domain's relation. An attacker who can enqueue a job directly (e.g. via a stolen Trigger.dev API token) could supply a domain_id from a different org and process takedowns under that org's billing/identity.

Fix

Add orgId to the query and make org_id required in PayloadSchema:

const domain = await db.query.domains.findFirst({
  where: and(
    eq(schema.domains.id, payload.domain_id),
    eq(schema.domains.orgId, payload.org_id)  // tenant fence
  )
})

Severity

LOW — only exploitable if Trigger.dev job dispatch API is reachable with a stolen token; the platform does not expose job dispatch to end-users today. Defend in depth.

Files

• packages/jobs/src/takedown.ts:113

[walidboulanouar]

Verified fixed in commit dcf195b — takedownJob fetches the domain org-scoped: and(id, eq(domains.orgId, payload.org_id)) (takedown.ts:228-231).