praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}

Summary

Type: Authorization bypass enabling destructive action. The DELETE /workspaces/{workspace_id} endpoint is gated only by require_workspace_member(workspace_id) (default min_role="member"). Any member of the workspace can issue a single DELETE to wipe the entire workspace, including every project, issue, comment, agent, label, and member record (cascading via the foreign-key relationships). There is no owner-role gate, no confirmation token, no soft-delete window, no recovery path. File: src/praisonai-platform/praisonai_platform/api/routes/workspaces.py, lines 77-86; services/workspace_service.py's delete() method. Root cause: the route uses Depends(require_workspace_member) which defaults to min_role="member" and is never overridden. The service method WorkspaceService.delete(workspace_id) performs the destructive operation without any caller-permission verification. The role hierarchy (MemberService.has_role, member_service.py:80-96) is implemented but unused for this endpoint.

Affected Code

File: src/praisonai-platform/praisonai_platform/api/routes/workspaces.py, lines 77-86.

@router.delete("/{workspace_id}", status_code=status.HTTP_204_NO_CONTENT)
async def delete_workspace(
    workspace_id: str,
    user: AuthIdentity = Depends(require_workspace_member),         # <-- BUG: defaults to min_role="member"
    session: AsyncSession = Depends(get_db),
):
    ws_svc = WorkspaceService(session)
    deleted = await ws_svc.delete(workspace_id)                     # <-- destructive, no role check
    if not deleted:
        raise HTTPException(status_code=404, detail="Workspace not found")

Why it's wrong: workspace deletion is the most destructive single action in this product — it wipes every member, project, issue, comment, agent, and label belonging to the tenant. The standard convention is to gate this on owner role, ideally with a confirmation parameter (typed workspace name) and a recovery window. This endpoint does none of that. The require_workspace_member(min_role) parameter exists precisely for this kind of tightening but is never invoked with anything other than the default.

Exploit Chain

1. Attacker is a member of workspace W (joined via invite, signup default, or any other route into membership). State: attacker holds JWT with Member(workspace_id=W, user_id=attacker, role="member").
2. Attacker sends with . State: control flow enters .