Scoped Authorization and Nested Resources

Scoped Authorization and Nested Resources

Authorization must bind the caller to the resource or client scope named by the request. Authentication and a broad role check alone do not establish access to a particular tenant's data or operation.

Bind the request to the caller's scope

Resolve the caller's identity and allowed scopes, then compare them with the requested resource before invoking a provider or performing a write. Preserve explicit provider-specific policy. An unrestricted staff identity in one application is not a general rule for other applications.

Test matching scope, foreign scope, missing scope, blank values, mixed scopes, and any privileged override. For denied cases, assert the response contract and that the provider or write path receives no call. An empty result and an HTTP 403 are different API contracts; choose and test the intended one.

Check the parent before the child

For nested resources, authorize access to the parent before probing the child. Then verify that the child belongs to that exact parent. Prefer a parent-constrained repository query over loading an unconstrained child and checking ownership afterward.

Test a valid parent with the wrong child, a foreign parent, and nonexistent resources. Where possible, assert that denied requests do not invoke child, snapshot, or provider reads; a denial response alone does not prove that no sensitive lookup occurred.

Waste Plus evidence

The reviewed implementation checks client scope for BCeID requests and retains an explicit unrestricted IDIR policy for selected operations. Its block-calculation service checks the reporting unit before retrieving the block snapshot and constrains block lookup to that reporting unit. These are application-specific policy examples, not defaults for other products.

The service source confirms parent-check ordering. The foreign-parent integration test does not itself spy on repository calls to prove that no child lookup occurred; add such an assertion if that no-probe property is part of the security contract.

Evidence sources

• backend/src/main/java/ca/bc/gov/nrs/hrs/controller/ReportingUnitController.java
• backend/src/main/java/ca/bc/gov/nrs/hrs/controller/ForestClientController.java
• backend/src/main/java/ca/bc/gov/nrs/hrs/service/block/BlockCalculationService.java
• backend/src/main/java/ca/bc/gov/nrs/hrs/controller/BlockCalculationController.java
• backend/src/test/java/ca/bc/gov/nrs/hrs/controller/ReportingUnitControllerIntegrationTest.java
• backend/src/test/java/ca/bc/gov/nrs/hrs/controller/ForestClientControllerIntegrationTest.java
• backend/src/test/java/ca/bc/gov/nrs/hrs/controller/BlockCalculationControllerIntegrationTest.java
• final/authorization-scope-final-report.md