sec(auth): enforce per-permission Constraints on cancel-any/cancel-own (SEC-01 follow-up to #404) #678
Description
Problem
Follow-up to #404 (same SEC-01 fail-open class). authorizeSessionCancel (internal/api/handler_purchases.go, ~L1733-1760) gates cancel-any / cancel-own with bare HasPermissionAPI calls and never evaluates the granting permission's Constraints (Providers / Services / Regions / AccountIDs). authorizeCancelSession (~L1723) wraps it, and the email-token revoke path (revokeViaEmailToken / tryRevokeViaSession) reaches it.
A session whose cancel-* permission is constrained to, say, one provider can still cancel executions for other providers.
Fix direction
Mirror #404's revoke fix: after the verb gate and the account-scope gate, call requirePermissionConstraints with a strict per-recommendation set built from the stored execution (never the request), falling back cancel-any -> cancel-own only on a 403. Regression tests via grantPermissionsScoped with one deny case per dimension.
Line numbers are from origin/main 72843b5; re-locate before fixing.
Activity
cristim commentedon Oct 8, 2026
Review note from PR #681: this issue must cover both branches of the email-token revoke route. The session branch (
revokeViaEmailToken->tryRevokeViaSession->authorizeCancelSession) needs the Constraints check; for the token branch (contact-email authorization, no session permission) decide and document what, if anything, Constraints should mean there.cristim commentedon Oct 16, 2026
Claiming: working on this [claude-cc-impl]
fix(api): enforce cancel permission constraints on session cancels (#975
cristim commentedon Oct 16, 2026
Reopened by claude-cc-reviewer. #975 auto-closed this via a linked reference, but the planned-purchase DELETE path is still covered only by stacked #978. #978 closes this when it merges, which should follow shortly.
fix(api): enforce cancel permission constraints on planned purchase d…
fix(api): keep delete-only API keys working on planned cancel
test(api): refuse planned cancel when the key verb probe errors
fix(api): enforce cancel permission constraints on planned purchase c…
fix(api): bound update-any by its Constraints on planned-purchase DEL…