PR Custody

fix(apollo): enforce shared-account ACL checks independent of 2FA entity mismatch flag

@kaavee315checks n/achecks…codex/fix-shared-account-acl-bypass-issue → master1 files · +24 −4review: @rohanprabhureview: @sarthakreview: @acsrujanreview: @anshugarg15updated 1w ago

GitHub

▸Description · 1 noise

Motivation

Prevent a security bypass where SHARED connected-account ACLs were only enforced when handleEntityIdMismatch (driven by projectConfig.is2FAEnabled) was true, which allowed direct connected_account_id usage to skip ACLs.
Ensure cross-user use of SHARED connections is always subject to the deny-wins ACL resolution regardless of unrelated project settings.
Fail closed when a caller supplies a connected_account_id for a SHARED connection without also providing a user_id/entity_id so ambiguous pins cannot bypass authorization.

Description

Decouples the SHARED-account ACL check from handleEntityIdMismatch so the ACL is always evaluated for cross-user SHARED usage in the single-account resolver (getOrFindActiveConnectedAccountNanoID).
Adds an explicit requirement that a user_id/entity_id must be present when a caller pins a SHARED connected_account_id, returning ConnectedAccountError.SharedAccessDenied if it is missing.
Applies the same enforcement and missing-user_id fail-closed behavior to the bulk resolver used by recipe/toolkit flows (getOrFindActiveConnectedAccountsBulk).
All changes are contained in apps/apollo/src/lib/connected_accounts/getOrFindConnectedAccount.ts (single and bulk paths) and preserve the existing ACL resolution logic (checkSharedAccountAccess).

Testing

Attempted to run the targeted unit test pnpm exec vitest run src/lib/connected_accounts/getOrFindConnectedAccount.acl.unit.test.ts, but the test run was blocked in this environment due to missing Doppler/secrets and required environment variables, so tests did not execute.
No CI test results are available from this environment run; the change is intentionally minimal to preserve existing behavior except for the decoupled ACL enforcement and added missing-user_id check.
Recommend running the repository test suite and relevant vitest units in CI (or a local environment with the required env var secrets) to validate behavior across all code paths.

Codex Task

▸ 1 bot/status comment hidden

@github-actions[bot]1w ago

🔍 Suggested Reviewers

Based on git blame analysis of 1 file(s):

Contributor	Contribution	Files
anshugarg15	51%	1
venkat82	30%	1
Zen	8%	1
Himanshu Dixit	5%	1
Himanshu Dixit	3%	1

💡 Recommendation

Based on git history, anshugarg15 or venkat82 would be good reviewer(s) for this PR.

🤖 Based on git blame with recency weighting (recent edits count more).

loading diff…