feat(http-utils): fan out payload scopes[] into AuthInfo with namespace + reserved-name guards (SITES-46454)#1676
Open
ravverma wants to merge 3 commits into
Open
feat(http-utils): fan out payload scopes[] into AuthInfo with namespace + reserved-name guards (SITES-46454)#1676ravverma wants to merge 3 commits into
ravverma wants to merge 3 commits into
Conversation
…ce + reserved-name guards (SITES-46454)
Phase 1 of multi-product login support. Extends JwtHandler.checkAuth
to map payload-side scopes[] strings (minted by spacecat-auth-service
for allow-listed IMS client_ids) into first-class AuthInfo scope
objects, so consumers can authorise via authInfo.hasScope(...) and
checkScopes(...) — the same surface used today for admin /
read_only_admin / per-tenant scopes.
Discipline (the JWT signature already prevents forgery — this is
shape hygiene to keep the minter and consumer well-defined):
- ALLOWED_PAYLOAD_SCOPE_NAMES is the canonical allow-list; entries
outside it are dropped and logged at warn-level. Starts with
sites:list:cross_product (the only Phase 1 scope).
- RESERVED_SCOPE_NAMES (admin / read_only_admin / user) are NEVER
sourced from payload.scopes[] — those scopes come exclusively
from the dedicated boolean / tenant claims. This prevents an
accidental future mint from synthesising a privileged scope.
- Non-string entries are dropped defensively.
Both constants are exported as the single source of truth shared
with the minter (spacecat-auth-service login.js).
Design ADR: adobe/mysticat-architecture#139
Jira: SITES-46454
Tests:
- allow-listed scope flows into AuthInfo.hasScope
- unknown scopes are dropped and warn-logged
- reserved names (admin, read_only_admin, user) cannot be elevated
via payload.scopes[]
- missing/empty scopes claim is a no-op
- non-string entries are dropped defensively
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
5 tasks
|
This PR will trigger a minor release when merged. |
MysticatBot
approved these changes
Jun 30, 2026
There was a problem hiding this comment.
Hey @ravverma,
Verdict: Approve - well-structured security feature with sound allow-list and reserved-name guards.
Complexity: HIGH - medium diff; auth signal.
Changes: Extends JwtHandler.checkAuth to fan out payload-side scopes[] into first-class AuthInfo scope objects with allow-list gating and reserved-name exclusion (2 files).
Non-blocking (4): minor issues and suggestions
- nit: Double
[jwt]prefix in log message - the newthis.log('[jwt] ignoring unknown payload scope...')call produces[jwt] [jwt] ignoring...becauseAbstractHandler.logalready prepends[jwt]. Drop the manual prefix to match the intended output. Consistent with the existing S2S log on line 63 (pre-existing), so non-blocking. -packages/spacecat-shared-http-utils/src/auth/handlers/jwt.js:108 - suggestion: Use
Setinstead ofArrayforALLOWED_PAYLOAD_SCOPE_NAMESandRESERVED_SCOPE_NAMES- communicates membership-test intent and gives O(1) lookup when the allow-list grows per the ADR amendment process. -packages/spacecat-shared-http-utils/src/auth/handlers/jwt.js:44-48 - suggestion: Add a test for non-array truthy
payload.scopesvalues (e.g., a string or object) to confirm theArray.isArrayguard handles them silently. -packages/spacecat-shared-http-utils/test/auth/handlers/jwt.test.js - suggestion: Consider deduplicating payload scopes before pushing to prevent duplicate
{ name }entries when the same scope string appears more than once inpayload.scopes[]. -packages/spacecat-shared-http-utils/src/auth/handlers/jwt.js:106
Skill: pr-review | Model: us.anthropic.claude-opus-4-6-v1[1m] | Duration: 1m 56s | Cost: $4.60 | Commit: 95452bac60de906fcdc4bafe1c525c5e35f2b821
If this code review was useful, please react with 👍. Otherwise, react with 👎.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Phase 1 of multi-product login support (SITES-46453). Extends
JwtHandler.checkAuthto map payload-sidescopes[]strings (minted byspacecat-auth-servicefor allow-listed IMSclient_ids) into first-classAuthInfoscope objects, so consumers can authorise viaauthInfo.hasScope(...)/checkScopes(...)— the same surface used today foradmin/read_only_admin/ per-tenant scopes.Companion PRs:
spacecat-auth-service— mints the scope (PR)spacecat-api-service— consumes the scope onGET /organizations/{id}/sites(PR; waits on this release)Design ADR: adobe/mysticat-architecture#139
Jira: SITES-46454 (parent: SITES-46453)
Discipline (the JWT signature already prevents forgery — this is shape hygiene)
ALLOWED_PAYLOAD_SCOPE_NAMES— canonical allow-list. Entries outside it are dropped andwarn-logged. Starts withsites:list:cross_product(the only Phase 1 scope). Grows by ADR amendment only.RESERVED_SCOPE_NAMES(admin/read_only_admin/user) — NEVER sourced frompayload.scopes[]. Those scopes come exclusively from the dedicated boolean / tenant claims. Prevents an accidental future mint from synthesising a privileged scope.Both constants are exported as the single source of truth shared with the minter.
Test plan
npm test -w packages/spacecat-shared-http-utils— 463 passing, 100% lines/statements coveragespacecat-shared-http-utilsgets a release the api-service can pick up🤖 Generated with Claude Code