feat(cli): allow using project name to resolve project ID (#2594)

[MuzzaiyyanHussain]

Summary

Introduced a new getProjectByName service method in projectServiceFactory to retrieve a project by its name.

Motivation

Currently, projects can only be retrieved using their ID or slug. This change adds the ability to fetch projects by their name while maintaining consistent permission checks and error handling.

Implementation Details

• Added getProjectByName method in project-service.ts
• Integrated permissionService.getProjectPermission to enforce access control
• Throws NotFoundError when the project name does not exist
• Throws ForbiddenError when the user lacks project read permissions

Impact

This improvement enhances developer experience when integrating APIs that rely on project names instead of IDs, making the API more flexible.

---

✅ Tested locally
✅ Follows existing service structure and permission model
✅ Non-breaking enhancement

[maidul98]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[greptile-apps]

Greptile Overview

Greptile Summary

Added new getProjectByName service method to retrieve projects by name. The implementation follows the existing permission model correctly with proper Read permission checks.

Critical Issue Found:

• The method queries projects using the name field, which is not unique within an organization. If multiple projects share the same name, findOne will return an arbitrary match, potentially granting unauthorized access to the wrong project.

Additional Observations:

• The method is added to the service factory exports but is not currently exposed via any API router, making this a safe internal addition
• Permission checks follow the existing pattern correctly (getProjectPermission + throwUnlessCan)
• Error handling matches other methods in the service

Confidence Score: 1/5

• This PR contains a critical security flaw that could grant access to the wrong project
• Score reflects the severe security risk from querying by non-unique name field. While permission checks are implemented correctly, the fundamental assumption that project names are unique is incorrect, which could lead to authorization bypass when duplicate names exist.
• backend/src/services/project/project-service.ts requires immediate attention - the query logic must be fixed before this can be safely exposed via API

Important Files Changed

File Analysis

Filename	Score	Overview
backend/src/services/project/project-service.ts	1/5	Added getProjectByName method with proper permission checks, but contains critical security flaw: queries by non-unique name field which could return wrong project

Sequence Diagram

sequenceDiagram
    participant Caller
    participant getProjectByName
    participant projectDAL
    participant permissionService
    
    Caller->>getProjectByName: name, actor, actorId, actorOrgId, actorAuthMethod
    getProjectByName->>projectDAL: findOne({ name, orgId })
    
    alt Project not found
        projectDAL-->>getProjectByName: null
        getProjectByName-->>Caller: throw NotFoundError
    else Project found
        projectDAL-->>getProjectByName: project
        getProjectByName->>permissionService: getProjectPermission(actor, actorId, projectId, etc)
        permissionService-->>getProjectByName: { permission }
        
        alt Lacks Read permission
            getProjectByName-->>Caller: throw ForbiddenError
        else Has Read permission
            getProjectByName-->>Caller: return project
        end
    end

Loading

[greptile-apps]

_{1 file reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

logic: project names are not unique within an org - multiple projects can share the same name. Using findOne with just name and orgId may return an arbitrary project if duplicates exist, potentially granting access to the wrong project. This is a critical security issue.

Verify project name uniqueness constraints in schema, or use slug instead (which is unique).

[MuzzaiyyanHussain]

@scott-ray-wilson