fix(api): validate source connection ownership

[fallintoplace]

Summary

The internal source API accepts any non-empty connection value when creating or updating a source. Unlike the external API v2 and MCP paths, it does not verify that the connection exists or belongs to the authenticated team.

That can leave sources pointing at missing connections or another team's ClickHouse credentials.

What changed

• Moved the existing connection validation into the connection controller.
• Applied it to internal POST /sources and PUT /sources/:id.
• Kept the external API v2 and MCP paths on the same shared validator.
• Preserved the existing 400 responses for malformed, missing, and inaccessible connection IDs.
• Kept local app mode compatible with its string team ID.

Tests

• Added internal API coverage for malformed connection IDs.
• Added coverage for missing and foreign-team connections.
• Verified rejected updates leave the existing source unchanged.
• Preserved coverage for successful source creation and updates.
• Targeted ESLint passes.

[vercel]

@fallintoplace is attempting to deploy a commit to the HyperDX Team on Vercel.

A member of the Team first needs to authorize it.

[greptile-apps]

Greptile Summary

The PR centralizes team-scoped source connection validation and applies it consistently to internal source creation and replacement while preserving external API and MCP validation.

• Moves validateConnectionId into the connection controller.
• Rejects malformed, missing, and foreign-team connection IDs before internal source writes.
• Adds integration coverage for rejection paths, unchanged updates, and local app mode.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
packages/api/src/controllers/connection.ts	Centralizes ObjectId parsing and team-scoped connection existence validation without changing the established external API behavior.
packages/api/src/routers/api/sources.ts	Adds ownership validation before internal source creation and replacement.
packages/api/src/mcp/tools/sources/saveSource.ts	Updates the MCP source-save path to import the same validator from its new controller location.
packages/api/src/routers/external-api/v2/sources.ts	Reuses the relocated validator while retaining the existing request middleware flow.
packages/api/src/routers/api/tests/sources.int.test.ts	Adds internal API coverage for malformed, nonexistent, foreign-team, unchanged-update, and local-mode cases.

Sequence Diagram

sequenceDiagram
    participant Client
    participant SourcesRoute
    participant Validator as validateConnectionId
    participant Connections as MongoDB Connections
    participant SourceController

    Client->>SourcesRoute: POST /sources or PUT /sources/:id
    SourcesRoute->>Validator: connection, authenticated team ID
    Validator->>Connections: "exists({_id: connection, team: teamId})"
    alt malformed, missing, or foreign connection
        Connections-->>Validator: no matching connection
        Validator-->>SourcesRoute: validation error
        SourcesRoute-->>Client: 400 response
    else owned connection exists
        Connections-->>Validator: match
        Validator-->>SourcesRoute: ok
        SourcesRoute->>SourceController: createSource or updateSource
        SourceController-->>Client: source response
    end

Loading

_{Reviews (2): Last reviewed commit: "fix(api): validate source connection in ..." | Re-trigger Greptile}

[pulpdrew]

Could we implement this in the handler instead of as a middleware? My concern with the middleware is lack of type safety, given we should have type safety in the handler due to validateRequest. I don't think we gain much from the middleware here since it's only used in two endpoints and is specific to a single payload shape.