fix(paroche): scope get_request to caller and redact indexer creds - #558
Merged
Conversation
… download_url
GET /api/v1/requests/{id} accepted any AuthenticatedUser and never checked
ownership — any member could read any other user's request by UUID (title,
decided_by, deny_reason, want_id). RequestService::get_request now takes the
authenticated caller_id and enforces the same owner-or-admin boundary as
cancel_request (non-owner member -> InsufficientPermission -> 403); the
signature change is threaded through DynRequestService, the aitesis impl,
the archon adapters, and the route handler.
GET /api/v1/downloads and POST /api/v1/search returned each item's raw
download_url, which by Torznab/Newznab convention embeds the indexer
apikey/passkey — a member-visible credential leak of the operator's
private-tracker keys. A lexical redaction helper (paroche::redact) now
replaces credential query-parameter values (apikey/passkey/authkey/token/
secret/r and variants, case-insensitive) with REDACTED on every outbound
response path: DownloadResponse::from and both search-result handlers.
The stored row and the enqueue/fetch path keep the real URL.
Gate-Passed: kanon 0.1.5 +stages:fmt,check,clippy,nextest,lint sha:23072b32135426354452cb9291f817c7de7acb1d
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two auth-boundary defects (deep-audit).
get_requestaccepted any authenticated user and never scoped to the caller, so any member could read any other user's request record by UUID. The caller'suser_idis now threaded throughRequestService::get_requestand enforcedis_owner || is_admin(non-owner non-admin → 403), mirroringcancel_request.download_urls that embed the indexerapikey/passkey. Aredact_download_urlhelper now replaces credential-param values withREDACTEDon the outbound response (queue snapshot + search); the internal enqueue/fetch path keeps the real URL. Inclusive key matching (apikey/api_key/passkey/torrent_pass/authkey/token/secret/…).Gate
kanon gate --fullgreen; endpoint-level tests assert owner/non-owner/admin access andapikey=REDACTEDin both response bodies.Closes #522
Closes #539