fix: enforce authorization on API events/archive action

The REST API archive action toggled an event's Archived
(retention-protection) flag with no authorization beyond the
controller's coarse "Events permission is not None" gate. Any
authenticated read-only user, including one restricted to a subset of
monitors, could flip the retention state of any event by enumerating
event ids, and the action was reachable over GET (CSRF-able).

Gate the write by direction: archiving (protects from purge) requires
view access via Event::canView(); un-archiving (re-exposes to purge)
requires edit access via Event::canEdit(). Both enforce the per-monitor
object-level ACL. Restrict the action to POST/PUT to block CSRF.

Addresses GHSA-5v9h-ww7p-hxgv.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: connortechnology

web/api/app/Controller/EventsController.php

@@ -540,15 +540,27 @@ public function archive($id = null) {
       throw new NotFoundException(__('Invalid event'));
     }
 
-    // Get the current value of Archive
+    // Toggling Archived mutates state, so restrict to state-changing verbs (not CSRF-able GET).
+    $this->request->allowMethod('post', 'put');
+
     $archived = $this->Event->find('first', array(
-      'fields' => array('Event.Archived'),
       'conditions' => array('Event.Id' => $id)
     ));
+    $EventObj = new ZM\Event($archived['Event']);
+
     // If 0, 1, if 1, 0
     $archiveVal = (($archived['Event']['Archived'] == 0) ? 1 : 0);
 
-    // Save the new value 
+    // Archiving protects an event from purge, so any user who can view the event may do it.
+    // Un-archiving makes it eligible for purge again, so that requires edit permission.
+    // Both canView() and canEdit() enforce the per-monitor object-level ACL.
+    $allowed = $archiveVal ? $EventObj->canView() : $EventObj->canEdit();
+    if ( !$allowed ) {
+      throw new UnauthorizedException(__('Insufficient Privileges'));
+      return;
+    }
+
+    // Save the new value
     $this->Event->id = $id;
     $this->Event->saveField('Archived', $archiveVal);