nocodb: testConnection endpoint now scopes integration access to workspace
The `testConnection` endpoint previously fetched integrations in a bypass scope and only checked that the integration was non-private and the caller had an owner/creator role on any base in any workspace.
What changed
The `testConnection` endpoint previously fetched integrations in a bypass scope and only checked that the integration was non-private and the caller had an owner/creator role on any base in any workspace. Now the permission lookup is scoped to the integration's workspace by joining on `fk_workspace_id`, and the controller rejects requests where the integration's workspace differs from the request's workspace.
Who it affects
Users with creator-or-owner role on any base in any workspace who could exploit cross-tenant access to integration configuration via the `testConnection` endpoint.
What to do today
Update nocodb to the latest patched version to restrict integration access to the correct workspace.