sendnrw/pocket-id
2
0
Fork 0
mirror of https://github.com/pocket-id/pocket-id.git synced 2026-10-10 11:49:05 +02:00
Code Issues Packages Projects Releases Wiki Activity

refactor: authorize API routes with per-endpoint scopes (#1823)

Browse Source 
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
This commit is contained in:
Elias Schneider
2026-10-09 21:33:14 +02:00
committed by GitHub
co-authored by copilot-swe-agent[bot]
parent 1bd6f006c8
commit 0ec6bfa191
48 changed files with 1422 additions and 681 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/internal/bootstrap/e2etest_router_bootstrap.go
+4 -4
View File
@@ -6,17 +6,17 @@ import (
"log/slog"
"os"
"github.com/gin-gonic/gin"
"gorm.io/gorm"
"github.com/pocket-id/pocket-id/backend/internal/authz"
"github.com/pocket-id/pocket-id/backend/internal/controller"
"github.com/pocket-id/pocket-id/backend/internal/service"
)
// When building for E2E tests, add the e2etest controller
func init() {
registerTestControllers = []func(apiGroup *gin.RouterGroup, db *gorm.DB, svc *services){
func(apiGroup *gin.RouterGroup, db *gorm.DB, svc *services) {
registerTestControllers = []func(apiRouter *authz.Router, db *gorm.DB, svc *services){
func(apiRouter *authz.Router, db *gorm.DB, svc *services) {
testService, err := service.NewTestService(db, svc.actors, svc.appConfigService, svc.jwtService, svc.ldapSyncModule, svc.fileStorage)
if err != nil {
slog.Error("Failed to initialize test service", slog.Any("error", err))
@@ -24,7 +24,7 @@ func init() {
return
}
controller.NewTestController(apiGroup, testService)
controller.NewTestController(apiRouter.Public(), testService)
},
}
}
backend/internal/bootstrap/route_coverage_test.go
+68
View File
@@ -0,0 +1,68 @@
package bootstrap
import (
"strings"
"testing"
"github.com/gin-gonic/gin"
"github.com/stretchr/testify/require"
"github.com/pocket-id/pocket-id/backend/internal/api"
"github.com/pocket-id/pocket-id/backend/internal/apikey"
"github.com/pocket-id/pocket-id/backend/internal/auditlogs"
"github.com/pocket-id/pocket-id/backend/internal/devicelogin"
"github.com/pocket-id/pocket-id/backend/internal/emailverification"
"github.com/pocket-id/pocket-id/backend/internal/environment"
"github.com/pocket-id/pocket-id/backend/internal/ldapsync"
"github.com/pocket-id/pocket-id/backend/internal/logopreset"
"github.com/pocket-id/pocket-id/backend/internal/middleware"
"github.com/pocket-id/pocket-id/backend/internal/oidc"
"github.com/pocket-id/pocket-id/backend/internal/onetimeaccess"
"github.com/pocket-id/pocket-id/backend/internal/scimsync"
"github.com/pocket-id/pocket-id/backend/internal/usersignup"
"github.com/pocket-id/pocket-id/backend/internal/webauthn"
)
// TestEveryAPIRouteDeclaresItsAccess builds the complete route table and fails when an API route was registered without declaring a scope or public access
func TestEveryAPIRouteDeclaresItsAccess(t *testing.T) {
gin.SetMode(gin.TestMode)
// Registration only stores handler references and never calls them, so modules without dependencies are enough
svc := &services{
apiKeyModule: &apikey.Module{},
auditLogsModule: &auditlogs.Module{},
deviceLoginModule: &devicelogin.Module{},
ldapSyncModule: &ldapsync.Module{},
scimSyncModule: &scimsync.Module{},
oidcModule: &oidc.Module{},
webauthnModule: &webauthn.Module{},
userSignUpModule: &usersignup.Module{},
oneTimeAccessModule: &onetimeaccess.Module{},
emailVerificationModule: &emailverification.Module{},
apiModule: &api.Module{},
environmentModule: &environment.Module{},
logoPresetModule: &logopreset.Module{},
}
engine := gin.New()
auth := middleware.NewAuthorization(nil, nil, nil)
require.NoError(t, registerRoutes(engine, nil, svc, auth, nil))
// Collect every API route that bypassed the authz routers
apiRoutes := 0
var undeclared []string
for _, route := range engine.Routes() {
if !strings.HasPrefix(route.Path, "/api/") {
continue
}
apiRoutes++
if !auth.IsDeclared(route.Method, route.Path) {
undeclared = append(undeclared, route.Method+" "+route.Path)
}
}
require.Empty(t, undeclared, "register these routes through authz.Router with a scope, or through Public() when they need no authentication")
// Guard against the table silently shrinking, which would make the coverage check vacuous
require.Greater(t, apiRoutes, 100)
}
backend/internal/bootstrap/router_bootstrap.go
+31 -41
View File
@@ -24,6 +24,7 @@ import (
"gorm.io/gorm"
"github.com/pocket-id/pocket-id/backend/frontend"
"github.com/pocket-id/pocket-id/backend/internal/authz"
"github.com/pocket-id/pocket-id/backend/internal/common"
"github.com/pocket-id/pocket-id/backend/internal/controller"
"github.com/pocket-id/pocket-id/backend/internal/middleware"
@@ -32,14 +33,15 @@ import (
)
// This is used to register additional controllers for tests
var registerTestControllers []func(apiGroup *gin.RouterGroup, db *gorm.DB, svc *services)
var registerTestControllers []func(apiRouter *authz.Router, db *gorm.DB, svc *services)
func initRouter(db *gorm.DB, svc *services, rateLimitServices map[string]*ratelimit.RateLimitService) (servicerunner.Service, error) {
r, err := initEngine()
if err != nil {
return nil, err
}
err = registerRoutes(r, db, svc, rateLimitServices)
auth := middleware.NewAuthorization(svc.apiKeyModule, svc.userService, svc.jwtService)
err = registerRoutes(r, db, svc, auth, rateLimitServices)
if err != nil {
return nil, err
}
@@ -135,7 +137,7 @@ func registerGlobalMiddleware(r *gin.Engine) {
r.Use(middleware.NewCrossOriginProtectionMiddleware(common.EnvConfig.AppURL).Add())
}
func registerRoutes(r *gin.Engine, db *gorm.DB, svc *services, rateLimitServices map[string]*ratelimit.RateLimitService) error {
func registerRoutes(r *gin.Engine, db *gorm.DB, svc *services, auth *authz.Middleware, rateLimitServices map[string]*ratelimit.RateLimitService) error {
err := frontend.RegisterFrontend(r)
if errors.Is(err, frontend.ErrFrontendNotIncluded) {
@@ -145,7 +147,6 @@ func registerRoutes(r *gin.Engine, db *gorm.DB, svc *services, rateLimitServices
}
// Initialize middleware for specific routes
authMiddleware := middleware.NewAuthMiddleware(svc.apiKeyModule, svc.userService, svc.jwtService)
fileSizeLimitMiddleware := middleware.NewFileSizeLimitMiddleware()
rateLimitMiddleware := middleware.NewRateLimitMiddleware(rateLimitServices)
apiRateLimitMiddleware := rateLimitMiddleware.Add(middleware.RateLimitAPI)
@@ -155,55 +156,44 @@ func registerRoutes(r *gin.Engine, db *gorm.DB, svc *services, rateLimitServices
apiGroup.Use(middleware.NewClientIDParamMiddleware().Add())
baseGroup := r.Group("/", apiRateLimitMiddleware)
svc.apiKeyModule.RegisterRoutes(apiGroup,
authMiddleware.WithAdminNotRequired().Add(),
authMiddleware.WithAdminNotRequired().WithApiKeyAuthDisabled().Add(),
)
svc.webauthnModule.RegisterRoutes(apiGroup,
authMiddleware.WithAdminNotRequired().Add(),
authMiddleware.WithAdminNotRequired().WithApiKeyAuthDisabled().Add(),
// Every route below declares the scope it requires, or that it is public, through these routers
apiRouter := auth.Router(apiGroup)
baseRouter := auth.Router(baseGroup)
svc.apiKeyModule.RegisterRoutes(apiRouter)
svc.webauthnModule.RegisterRoutes(apiRouter,
rateLimitMiddleware.Add(middleware.RateLimitWebauthnLogin),
rateLimitMiddleware.Add(middleware.RateLimitWebauthnReauthenticate),
)
svc.deviceLoginModule.RegisterRoutes(apiGroup,
authMiddleware.WithAdminNotRequired().WithApiKeyAuthDisabled().Add(),
svc.deviceLoginModule.RegisterRoutes(apiRouter,
rateLimitMiddleware.Add(middleware.RateLimitDeviceLoginCreate),
rateLimitMiddleware.Add(middleware.RateLimitDeviceLoginExchange),
rateLimitMiddleware.Add(middleware.RateLimitDeviceLoginVerification),
)
controller.NewOidcController(apiGroup, authMiddleware, fileSizeLimitMiddleware, svc.oidcService, svc.appConfigService)
controller.NewUserController(apiGroup, authMiddleware, fileSizeLimitMiddleware, svc.appConfigService, svc.userService, svc.webauthnModule, rateLimitMiddleware.Add(middleware.RateLimitUpdateOwnAccount))
controller.NewAppConfigController(apiGroup, authMiddleware, svc.appConfigService, svc.emailModule)
svc.ldapSyncModule.RegisterRoutes(apiGroup, authMiddleware.Add())
controller.NewAppImagesController(apiGroup, authMiddleware, fileSizeLimitMiddleware, svc.appImagesService)
svc.auditLogsModule.RegisterRoutes(apiGroup, authMiddleware.Add(), authMiddleware.WithAdminNotRequired().Add())
controller.NewUserGroupController(apiGroup, authMiddleware, svc.appConfigService, svc.userGroupService)
svc.apiModule.RegisterRoutes(apiGroup, authMiddleware.Add())
controller.NewCustomClaimController(apiGroup, authMiddleware, svc.customClaimService)
svc.environmentModule.RegisterRoutes(apiGroup, authMiddleware.WithAdminNotRequired().Add())
svc.logoPresetModule.RegisterRoutes(apiGroup, authMiddleware.Add())
svc.scimSyncModule.RegisterRoutes(apiGroup, authMiddleware.Add())
svc.userSignUpModule.RegisterRoutes(apiGroup,
authMiddleware.Add(),
rateLimitMiddleware.Add(middleware.RateLimitSignup),
)
svc.oneTimeAccessModule.RegisterRoutes(apiGroup,
authMiddleware.Add(),
controller.NewOidcController(apiRouter, fileSizeLimitMiddleware, svc.oidcService, svc.appConfigService)
controller.NewUserController(apiRouter, fileSizeLimitMiddleware, svc.appConfigService, svc.userService, svc.webauthnModule, rateLimitMiddleware.Add(middleware.RateLimitUpdateOwnAccount))
controller.NewAppConfigController(apiRouter, svc.appConfigService, svc.emailModule)
svc.ldapSyncModule.RegisterRoutes(apiRouter)
controller.NewAppImagesController(apiRouter, fileSizeLimitMiddleware, svc.appImagesService)
svc.auditLogsModule.RegisterRoutes(apiRouter)
controller.NewUserGroupController(apiRouter, svc.appConfigService, svc.userGroupService)
svc.apiModule.RegisterRoutes(apiRouter)
controller.NewCustomClaimController(apiRouter, svc.customClaimService)
svc.environmentModule.RegisterRoutes(apiRouter)
svc.logoPresetModule.RegisterRoutes(apiRouter)
svc.scimSyncModule.RegisterRoutes(apiRouter)
svc.userSignUpModule.RegisterRoutes(apiRouter, rateLimitMiddleware.Add(middleware.RateLimitSignup))
svc.oneTimeAccessModule.RegisterRoutes(apiRouter,
rateLimitMiddleware.Add(middleware.RateLimitOneTimeAccessToken),
rateLimitMiddleware.Add(middleware.RateLimitOneTimeAccessEmail),
)
svc.emailVerificationModule.RegisterRoutes(
apiGroup,
authMiddleware.WithAdminNotRequired().Add(),
svc.emailVerificationModule.RegisterRoutes(apiRouter,
rateLimitMiddleware.Add(middleware.RateLimitSendEmailVerification),
rateLimitMiddleware.Add(middleware.RateLimitVerifyEmail),
)
svc.oidcModule.RegisterRoutes(baseRouter, apiRouter)
optionalBrowserAuth := authMiddleware.WithAdminNotRequired().WithSuccessOptional().WithApiKeyAuthDisabled().Add()
browserAuth := authMiddleware.WithAdminNotRequired().WithApiKeyAuthDisabled().Add()
svc.oidcModule.RegisterRoutes(baseGroup, apiGroup, optionalBrowserAuth, browserAuth)
registerTestRoutes(apiGroup, db, svc)
registerTestRoutes(apiRouter, db, svc)
controller.NewWellKnownController(baseGroup, svc.jwtService, svc.appConfigService.GetCIMDURLAllowlist)
@@ -217,13 +207,13 @@ func registerRoutes(r *gin.Engine, db *gorm.DB, svc *services, rateLimitServices
return nil
}
func registerTestRoutes(apiGroup *gin.RouterGroup, db *gorm.DB, svc *services) {
func registerTestRoutes(apiRouter *authz.Router, db *gorm.DB, svc *services) {
if common.EnvConfig.AppEnv.IsProduction() {
return
}
for _, f := range registerTestControllers {
f(apiGroup, db, svc)
f(apiRouter, db, svc)
}
}