Skip to content

sec(api): apply account-scope gate to approve/cancel/retry/revoke purchase endpoints #381

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cristim merged 4 commits into from
Sep 28, 2026
Merged

sec(api): apply account-scope gate to approve/cancel/retry/revoke purchase endpoints #381

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f118f12
sec(api): apply account-scope gate to approve/cancel/retry/revoke pur…
cristim Sep 28, 2026
7643708
sec(api): scope purchase executions by their own account, scope gate …
cristim Sep 28, 2026
5907bb8
sec(api): scope executions by every account they can buy in
cristim Sep 28, 2026
226ae97
sec(api): check revoke status only after authorization
cristim Sep 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions internal/api/coverage_extras_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,8 @@ func TestHandler_approvePurchase_PurchaseError(t *testing.T) {
mockConfig.On("GetGlobalConfig", ctx).Return(&config.GlobalConfig{}, nil)

mockAuth := new(MockAuthService)

mockAuth.On("GetAllowedAccountsAPI", mock.Anything, mock.Anything).Return(nil, nil).Maybe()
mockAuth.On("ValidateSession", ctx, "sess-tok").Return(&Session{Email: approver}, nil)
// After issue #286, approvePurchase is session-first: with a Bearer
// header present the dispatch consults the approve-{any,own} RBAC
Expand Down Expand Up @@ -155,6 +157,8 @@ func TestHandler_cancelPurchase_PurchaseError(t *testing.T) {
mockConfig.On("GetGlobalConfig", ctx).Return(&config.GlobalConfig{}, nil)

mockAuth := new(MockAuthService)

mockAuth.On("GetAllowedAccountsAPI", mock.Anything, mock.Anything).Return(nil, nil).Maybe()
mockAuth.On("ValidateSession", ctx, "sess-tok").Return(&Session{Email: approver}, nil)
// Session has no admin role / cancel permissions → cancelPurchase's
// session-authed pre-check falls through to authorizeApprovalAction →
Expand Down
4 changes: 4 additions & 0 deletions internal/api/executed_notification_flow_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,8 @@ func TestExecutedNotification_TokenApprovePath(t *testing.T) {
}, nil)

mockAuth := new(MockAuthService)

mockAuth.On("GetAllowedAccountsAPI", mock.Anything, mock.Anything).Return(nil, nil).Maybe()
mockAuth.On("ValidateSession", ctx, "sess-tok").Return(&Session{Email: contact}, nil)
mockAuth.On("HasPermissionAPI", ctx, "", "approve-any", "purchases").Return(false, nil).Maybe()
mockAuth.On("HasPermissionAPI", ctx, "", "approve-own", "purchases").Return(false, nil).Maybe()
Expand Down Expand Up @@ -166,6 +168,8 @@ func TestExecutedNotification_TokenApprovePath_RefetchFailureSuppressesPanel(t *
}, nil)

mockAuth := new(MockAuthService)

mockAuth.On("GetAllowedAccountsAPI", mock.Anything, mock.Anything).Return(nil, nil).Maybe()
mockAuth.On("ValidateSession", ctx, "sess-tok").Return(&Session{Email: contact}, nil)
mockAuth.On("HasPermissionAPI", ctx, "", "approve-any", "purchases").Return(false, nil).Maybe()
mockAuth.On("HasPermissionAPI", ctx, "", "approve-own", "purchases").Return(false, nil).Maybe()
Expand Down
Loading
Loading