PR Custody

fix(auth-configs): enforce RBAC write checks for auth-config mutations

@kaavee315checks n/achecks…codex/propose-fix-for-viewer-authorization-flaw → master5 files · +131 −0review: @rohanprabhureview: @sohamganatrareview: @sarthakreview: @acsrujanreview: @anshugarg15updated 2d ago

GitHub

▸Description· 2 comments

Motivation

A recent change allowed inviting users as VIEWER while RBAC declared VIEWER should be read-only, exposing dashboard mutation endpoints that only verified project membership to unauthorized writes.
The goal is to prevent low-privileged org members from creating/updating/deleting auth configs and keep the VIEWER role boundary consistent across API surfaces.

Description

Add a reusable permission guard verifyAuthConfigWritePermission that calls the RBAC provider to assert write access on the authConfigs DB resource (apps/apollo/src/lib/auth_config/permissions.ts).
Enforce this guard on dashboard internal mutation routes for auth-configs: create/update/delete/status toggle (apps/apollo/src/pages/api/internal-dashboard/consumer/auth-configs/*).
Enforce the same guard on public v3 auth-config mutation routes so the API surfaces are consistent (apps/apollo/src/pages/api/v3/auth_configs.ts and apps/apollo/src/pages/api/v3/auth_configs/[nanoid].ts).
Extend RBAC unit test coverage to assert VIEWER is denied write access to the db:authConfigs resource (apps/apollo/src/lib/rbac/model.test.ts).

Testing

Ran formatting check with pnpm exec oxfmt --check for the modified files, which succeeded.
Attempted unit test run cd apps/apollo && pnpm with-env vitest run src/lib/rbac/model.test.ts; the test runner failed in this environment because the workspace package @composio/lib could not be resolved (unbuilt workspace dependency), so unit tests could not complete.
Ran type checks with cd apps/apollo && pnpm check-types; this failed due to existing generated/type-resolution issues in the environment (missing generated Thermos modules and Prisma/@prisma client exports) unrelated to the permission logic introduced by this PR.

Codex Task

@KJ-112d ago

most of this is already in #10577 (merged yesterday) - it added assertOrgMemberCanWriteAuthConfig and gated the internal-dashboard routes there. this PR's verifyAuthConfigWritePermission is basically a dupe of that

v3 routes are the one thing #10577 didn't cover though. mind if i take it from here and trim it down to just those?

@CryogenicPlanet2d ago

this is also an api key only route, viewers cannot create api keys so they cannot access this route this gate in this manner doesn't need to exist

loading diff…