From 355740ee8c824eac72e452ca7f11d02e9e18695a Mon Sep 17 00:00:00 2001 From: Ravi Verma Date: Wed, 15 Jul 2026 12:41:01 +0530 Subject: [PATCH 1/4] fix: moving region end point to required capability with read --- src/routes/required-capabilities.js | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/routes/required-capabilities.js b/src/routes/required-capabilities.js index 170304594..7a1524485 100644 --- a/src/routes/required-capabilities.js +++ b/src/routes/required-capabilities.js @@ -173,9 +173,6 @@ export const INTERNAL_ROUTES = [ 'POST /ephemeral-run/batch', 'GET /ephemeral-run/batch/:batchId/status', - // Regions lookup - global table, no org scope; session-token authenticated, not for S2S consumers - 'GET /v2/regions', - // Monitoring - DRS Brand Presence PostgREST audit proxy. Called by DRS monitoring workers // via admin x-api-key only (DRS runs in a separate AWS account and holds no S2S consumer // registration). Kept internal because reusing `audit:read` would silently broaden that @@ -257,6 +254,9 @@ const routeRequiredCapabilities = { 'PUT /configurations/latest/handlers/:handlerType/replace-enabled-disabled': CAP_CONFIGURATION_WRITE, 'PATCH /configurations/sites/audits': CAP_CONFIGURATION_WRITE, + // Regions lookup - global table, no org scope; session-token authenticated, not for S2S consumers + 'GET /v2/regions': 'organization:read', + // Organizations 'GET /organizations': CAP_ORG_READ_ALL, 'POST /organizations': 'organization:write', From c32296f9131572b4a31410c0fce829a5859315f3 Mon Sep 17 00:00:00 2001 From: Ravi Verma <46780200+ravverma@users.noreply.github.com> Date: Wed, 15 Jul 2026 12:58:53 +0530 Subject: [PATCH 2/4] fix: correct stale S2S comment on GET /v2/regions capability entry The route now lives in routeRequiredCapabilities, which the S2S wrapper also consumes, so it is reachable by any consumer holding organization:read. The carried-over 'not for S2S consumers' note was stale and misleading. --- src/routes/required-capabilities.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/routes/required-capabilities.js b/src/routes/required-capabilities.js index 7a1524485..eb6c7b5e2 100644 --- a/src/routes/required-capabilities.js +++ b/src/routes/required-capabilities.js @@ -254,7 +254,7 @@ const routeRequiredCapabilities = { 'PUT /configurations/latest/handlers/:handlerType/replace-enabled-disabled': CAP_CONFIGURATION_WRITE, 'PATCH /configurations/sites/audits': CAP_CONFIGURATION_WRITE, - // Regions lookup - global table, no org scope; session-token authenticated, not for S2S consumers + // Regions lookup - global table, no org scope; readable by any consumer (session-token or S2S) holding organization:read 'GET /v2/regions': 'organization:read', // Organizations From 86f11b93b5ec1c6e450f0293e42218594228f33b Mon Sep 17 00:00:00 2001 From: Ravi Verma <46780200+ravverma@users.noreply.github.com> Date: Wed, 15 Jul 2026 13:03:03 +0530 Subject: [PATCH 3/4] fix: wrap GET /v2/regions capability comment to satisfy max-len lint --- src/routes/required-capabilities.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/routes/required-capabilities.js b/src/routes/required-capabilities.js index eb6c7b5e2..b8283207d 100644 --- a/src/routes/required-capabilities.js +++ b/src/routes/required-capabilities.js @@ -254,7 +254,8 @@ const routeRequiredCapabilities = { 'PUT /configurations/latest/handlers/:handlerType/replace-enabled-disabled': CAP_CONFIGURATION_WRITE, 'PATCH /configurations/sites/audits': CAP_CONFIGURATION_WRITE, - // Regions lookup - global table, no org scope; readable by any consumer (session-token or S2S) holding organization:read + // Regions lookup - global table, no org scope; readable by any consumer + // (session-token or S2S) holding organization:read 'GET /v2/regions': 'organization:read', // Organizations From 31ee86c817129b1cf2a3cd5c85a643941079db5c Mon Sep 17 00:00:00 2001 From: Ravi Verma <46780200+ravverma@users.noreply.github.com> Date: Wed, 15 Jul 2026 14:05:50 +0530 Subject: [PATCH 4/4] fix: move brand-presence/stats routes to brand:read capability Move 'GET /org/:spaceCatId/brands/all/brand-presence/stats' and 'GET /org/:spaceCatId/brands/:brandId/brand-presence/stats' out of INTERNAL_ROUTES into routeRequiredCapabilities with brand:read, matching the sibling brand-presence routes (filter-dimensions, weeks, etc.). --- src/routes/required-capabilities.js | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/src/routes/required-capabilities.js b/src/routes/required-capabilities.js index b8283207d..64b8a3c71 100644 --- a/src/routes/required-capabilities.js +++ b/src/routes/required-capabilities.js @@ -65,10 +65,6 @@ export const INTERNAL_ROUTES = [ 'POST /slack/events', 'POST /slack/channels/invite-by-user-id', - // Brand Presence stats - org-scoped, LLMO product; not yet required by S2S consumers - 'GET /org/:spaceCatId/brands/all/brand-presence/stats', - 'GET /org/:spaceCatId/brands/:brandId/brand-presence/stats', - // Agentic traffic PG dashboard endpoints (site-scoped) - non-mutating POST queries // (complex payloads / export trigger); UI only, not yet required by S2S 'POST /sites/:siteId/agentic-traffic/hits-by-urls', @@ -320,6 +316,8 @@ const routeRequiredCapabilities = { 'GET /org/:spaceCatId/brands/:brandId/fanout-report': 'brand:read', 'GET /org/:spaceCatId/brands/all/brand-presence/filter-dimensions': 'brand:read', 'GET /org/:spaceCatId/brands/:brandId/brand-presence/filter-dimensions': 'brand:read', + 'GET /org/:spaceCatId/brands/all/brand-presence/stats': 'brand:read', + 'GET /org/:spaceCatId/brands/:brandId/brand-presence/stats': 'brand:read', 'GET /org/:spaceCatId/brands/all/brand-presence/weeks': 'brand:read', 'GET /org/:spaceCatId/brands/:brandId/brand-presence/weeks': 'brand:read', 'GET /org/:spaceCatId/brands/all/brand-presence/sentiment-overview': 'brand:read',