From a0d861028d931f8a54387770eaf3a75031b81234 Mon Sep 17 00:00:00 2001 From: Jan Cizmar Date: Wed, 17 Apr 2024 17:35:07 +0200 Subject: [PATCH] fix: Admin should not bypass auth when using API key (#2257) --- .../ProjectAuthorizationInterceptor.kt | 2 +- .../ProjectAuthorizationInterceptorTest.kt | 17 +++++++++++++++++ 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/backend/security/src/main/kotlin/io/tolgee/security/authorization/ProjectAuthorizationInterceptor.kt b/backend/security/src/main/kotlin/io/tolgee/security/authorization/ProjectAuthorizationInterceptor.kt index a207b4bdcd..a10f4fcd42 100644 --- a/backend/security/src/main/kotlin/io/tolgee/security/authorization/ProjectAuthorizationInterceptor.kt +++ b/backend/security/src/main/kotlin/io/tolgee/security/authorization/ProjectAuthorizationInterceptor.kt @@ -90,7 +90,7 @@ class ProjectAuthorizationInterceptor( val missingScopes = getMissingScopes(requiredScopes, scopes.toSet()) if (missingScopes.isNotEmpty()) { - if (!isAdmin) { + if (!isAdmin || authenticationFacade.isProjectApiKeyAuth) { logger.debug( "Rejecting access to proj#{} for user#{} - Insufficient permissions", project.id, diff --git a/backend/security/src/test/kotlin/io/tolgee/security/authorization/ProjectAuthorizationInterceptorTest.kt b/backend/security/src/test/kotlin/io/tolgee/security/authorization/ProjectAuthorizationInterceptorTest.kt index 7642e88ea8..b707dd3fa7 100644 --- a/backend/security/src/test/kotlin/io/tolgee/security/authorization/ProjectAuthorizationInterceptorTest.kt +++ b/backend/security/src/test/kotlin/io/tolgee/security/authorization/ProjectAuthorizationInterceptorTest.kt @@ -25,6 +25,7 @@ import io.tolgee.fixtures.andIsForbidden import io.tolgee.fixtures.andIsNotFound import io.tolgee.fixtures.andIsOk import io.tolgee.model.Project +import io.tolgee.model.UserAccount import io.tolgee.model.enums.Scope import io.tolgee.security.OrganizationHolder import io.tolgee.security.ProjectHolder @@ -156,6 +157,22 @@ class ProjectAuthorizationInterceptorTest { mockMvc.perform(MockMvcRequestBuilders.get("/v2/projects/1337/requires-single-scope")).andIsOk } + @Test + fun `rejects access if the user is admin and authorizes with API key`() { + Mockito.`when`(authenticationFacade.isApiAuthentication).thenReturn(false) + Mockito.`when`(userAccount.role).thenReturn(UserAccount.Role.ADMIN) + + Mockito.`when`(securityService.getCurrentPermittedScopes(1337L)) + .thenReturn(setOf(Scope.KEYS_VIEW)) + + mockMvc.perform(MockMvcRequestBuilders.get("/v2/projects/1337/requires-single-scope")).andIsOk + + Mockito.`when`(authenticationFacade.isProjectApiKeyAuth).thenReturn(true) + Mockito.`when`(userAccount.role).thenReturn(UserAccount.Role.ADMIN) + + mockMvc.perform(MockMvcRequestBuilders.get("/v2/projects/1337/requires-single-scope")).andIsForbidden + } + @Test fun `rejects access if the user does not have the required scope (multiple scopes)`() { Mockito.`when`(securityService.getCurrentPermittedScopes(1337L))