From bdc572dfbafa99b910f221f7256900e201e311ac Mon Sep 17 00:00:00 2001
From: Emily Turner <emily.turner@nimbisservices.com>
Date: Fri, 1 Aug 2025 08:22:21 -0400
Subject: [PATCH] Fix: "My Virtual Desktop" view shows other users' desktops

Replaced `value` filter for the `owner` field with `eq` filter in the `list_all_for_user` function. Added additional `owner` filtering in `fetchUserSessions` function.

"My Virtual Desktop" view incorrectly showed all Virtual Desktops whose "owner" field contained the user's username. For example, user `an` can view all of user `ryan`'s Virtual Desktops, regardless of user's permissions.
---
 .../my-virtual-desktop-sessions.tsx               | 15 +++++++++++++--
 .../app/sessions/virtual_desktop_session_db.py    |  4 ++--
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/source/idea/idea-cluster-manager/webapp/src/pages/virtual-desktops/my-virtual-desktop-sessions.tsx b/source/idea/idea-cluster-manager/webapp/src/pages/virtual-desktops/my-virtual-desktop-sessions.tsx
index b08f60c..26a8e9f 100644
--- a/source/idea/idea-cluster-manager/webapp/src/pages/virtual-desktops/my-virtual-desktop-sessions.tsx
+++ b/source/idea/idea-cluster-manager/webapp/src/pages/virtual-desktops/my-virtual-desktop-sessions.tsx
@@ -260,7 +260,7 @@ class MyVirtualDesktopSessions extends Component<MyVirtualDesktopSessionsProps,
                     },
                     {
                         key: "owner",
-                        value: AppContext.get().auth().getUsername(),
+                        eq: AppContext.get().auth().getUsername(),
                     }
                 ],
                 paginator: {
@@ -272,7 +272,18 @@ class MyVirtualDesktopSessions extends Component<MyVirtualDesktopSessionsProps,
             cursor = result.paginator?.cursor;
         } while (cursor);
 
-        return response;
+        const filteredResponse: ListSessionsResponse = {
+            paginator: { page_size: 100 },
+            listing: [],
+        }
+
+        response.listing?.forEach(function(element) {
+            if(element.owner === AppContext.get().auth().getUsername()) {
+                filteredResponse.listing?.push(element);
+            }
+        });
+
+        return filteredResponse;
     }
 
     setFlashMessage = (content: React.ReactNode, type: "success" | "info" | "error") => {
diff --git a/source/idea/idea-virtual-desktop-controller/src/ideavirtualdesktopcontroller/app/sessions/virtual_desktop_session_db.py b/source/idea/idea-virtual-desktop-controller/src/ideavirtualdesktopcontroller/app/sessions/virtual_desktop_session_db.py
index 273c38f..4a08633 100644
--- a/source/idea/idea-virtual-desktop-controller/src/ideavirtualdesktopcontroller/app/sessions/virtual_desktop_session_db.py
+++ b/source/idea/idea-virtual-desktop-controller/src/ideavirtualdesktopcontroller/app/sessions/virtual_desktop_session_db.py
@@ -302,7 +302,7 @@ def list_all_for_user(self, request: ListSessionsRequest, username: str) -> List
             
         request.filters.append(SocaFilter(
             key=sessions_constants.USER_SESSION_DB_FILTER_OWNER_KEY,
-            value=username
+            eq=username
         ))
         return self.list_all_from_db(request)
 
@@ -317,4 +317,4 @@ def list_all_for_software_stack(self, request: ListSessionsRequest, software_sta
             key=sessions_constants.USER_SESSION_DB_SOFTWARE_STACK_KEY,
             eq=self._software_stack_db.convert_software_stack_object_to_db_dict(software_stack)
         ))
-        return self.list_all_from_db(request)
\ No newline at end of file
+        return self.list_all_from_db(request)