fix(handler): gate /api/audit on Universe staff team

Author: raisedadead

.env.example

@@ -47,6 +47,7 @@ VALKEY_ADDR=localhost:6379
 # GH_REPO_ORG=freeCodeCamp-Universe   # org repos are created in + teams gate repo authz
 # REPO_CREATE_AUTHZ_TEAM=staff        # gates POST /api/repo
 # REPO_APPROVE_AUTHZ_TEAM=none        # gates approve/reject/delete; production must override
+# AUDIT_READ_AUTHZ_TEAM=staff         # gates GET /api/audit; team in GH_REPO_ORG, probed via Universe-org client
 # GH_APP_ID=                          # Apollo-11 GitHub App id (digits only)
 # GH_APP_INSTALLATION_ID=             # App installation id (digits only)
 # GH_APP_PRIVATE_KEY=                 # App private key PEM (PKCS#1 or PKCS#8)

cmd/artemis/main.go

@@ -270,6 +270,7 @@ func run() error {
 		RepoOrg:              cfg.Repo.Org,
 		RepoCreateAuthzTeam:  cfg.Repo.CreateAuthzTeam,
 		RepoApproveAuthzTeam: cfg.Repo.ApproveAuthzTeam,
+		AuditReadAuthzTeam:   cfg.Repo.AuditReadAuthzTeam,
 		NewDeployID:          r2.NewDeployID,
 		Now:                  time.Now,
 	}

docs/README.md

@@ -40,7 +40,7 @@ POST   /api/deploy/{deployId}/finalize    { mode }              → { url }
 
 `/api/repo*` is mounted only when `RepoEnabled()` is true (Apollo-11 App credentials configured — see Configuration). `DELETE /api/site/{slug}?purge=true` additionally moves the site's R2 prefix to `_trash/` and records a tombstone (gated the same as the plain delete); the bare `DELETE` only removes the registry row. `POST /api/site/{site}/deploys/{deployId}/restore` reverses a `DELETE .../deploys/{deployId}` tombstone, moving the bytes back from `_trash/` and re-marking the deploy active; `GET /api/site/{site}/trash` lists the site's tombstoned deploys with their purge-eligibility `expiresAt` (`CLEANUP_RECOVERY_DAYS` out from `trashedAt`).
 
-`GET /api/audit` reads the durable, append-only `audit_log` — every privileged action (deploy, site, repo lifecycle, GC tombstone/reconcile) attributed to an actor. Filter by `site` / `actor` / `action` / `since` (RFC3339), paginated (`limit` default 100, max 500; `offset`), newest-first. It replaces the raw-`psql`-on-prod path for reading the trail. From the CLI: `universe audit ls [--actor --action --site --since --limit] [--json]` (universe-cli release follows artemis v1.5.0, since it depends on the deployed endpoint).
+`GET /api/audit` reads the durable, append-only `audit_log` — every privileged action (deploy, site, repo lifecycle, GC tombstone/reconcile) attributed to an actor. Filter by `site` / `actor` / `action` / `since` (RFC3339), paginated (`limit` default 100, max 500; `offset`), newest-first. It replaces the raw-`psql`-on-prod path for reading the trail. Because the trail is cross-tenant, the endpoint is team-gated: the caller must be on the Universe-org staff team (`AUDIT_READ_AUTHZ_TEAM`, default `staff`) — not merely any authenticated GitHub bearer. From the CLI: `universe audit ls [--actor --action --site --since --limit] [--json]` (universe-cli release follows artemis v1.5.0, since it depends on the deployed endpoint).
 
 Auth headers (`/api/*` except `/healthz`, `/readyz`):
 
@@ -49,7 +49,7 @@ Auth headers (`/api/*` except `/healthz`, `/readyz`):
 | `GET /api/*`, `POST /api/deploy/init`, `POST /api/site/*`, `POST`/`GET`/`DELETE /api/repo*` | GitHub token (PAT / OIDC)                                                    |
 | `PUT /api/deploy/{deployId}/upload`, `POST /api/deploy/{deployId}/finalize`                 | Deploy-session JWT (HS256, ≤15 min, scoped to one `(login, site, deployId)`) |
 
-Team-gated beyond the base GitHub-bearer check: `POST /api/site/register`, `PATCH /api/site/{slug}`, `DELETE /api/site/{slug}` (`REGISTRY_AUTHZ_TEAM`); `POST /api/repo` (`REPO_CREATE_AUTHZ_TEAM`); `POST /api/repo/{id}/approve`, `POST /api/repo/{id}/reject`, `DELETE /api/repo/{id}` (`REPO_APPROVE_AUTHZ_TEAM`). All other `/api/*` reads are open to any authenticated GitHub bearer.
+Team-gated beyond the base GitHub-bearer check: `POST /api/site/register`, `PATCH /api/site/{slug}`, `DELETE /api/site/{slug}` (`REGISTRY_AUTHZ_TEAM`); `POST /api/repo` (`REPO_CREATE_AUTHZ_TEAM`); `POST /api/repo/{id}/approve`, `POST /api/repo/{id}/reject`, `DELETE /api/repo/{id}` (`REPO_APPROVE_AUTHZ_TEAM`); `GET /api/audit` (`AUDIT_READ_AUTHZ_TEAM`, the sole team-gated read — cross-tenant trail). All other `/api/*` reads are open to any authenticated GitHub bearer.
 
 ## Configuration (env-driven)
 
@@ -91,14 +91,15 @@ Loaded + validated in `internal/config/config.go` (`Load()` — fails fast on th
 
 **Repo-creation (Apollo-11, feature-gated)**
 
-| Variable                  | Default                      | Description                                                                     |
-| ------------------------- | ---------------------------- | ------------------------------------------------------------------------------- |
-| `GH_REPO_ORG`             | `freeCodeCamp-Universe`      | Org repos are created in + whose teams gate repo authz (distinct from `GH_ORG`) |
-| `REPO_CREATE_AUTHZ_TEAM`  | `staff`                      | GH team gating `POST /api/repo`                                                 |
-| `REPO_APPROVE_AUTHZ_TEAM` | `none`                       | GH team gating approve/reject/delete; placeholder — production must override    |
-| `GH_APP_ID`               | _(empty → repo feature off)_ | Apollo-11 GitHub App id (numeric string)                                        |
-| `GH_APP_INSTALLATION_ID`  | _(empty)_                    | App installation id (numeric string)                                            |
-| `GH_APP_PRIVATE_KEY`      | _(empty)_                    | App private key PEM (PKCS#1 or PKCS#8)                                          |
+| Variable                  | Default                      | Description                                                                            |
+| ------------------------- | ---------------------------- | -------------------------------------------------------------------------------------- |
+| `GH_REPO_ORG`             | `freeCodeCamp-Universe`      | Org repos are created in + whose teams gate repo authz (distinct from `GH_ORG`)        |
+| `REPO_CREATE_AUTHZ_TEAM`  | `staff`                      | GH team gating `POST /api/repo`                                                        |
+| `REPO_APPROVE_AUTHZ_TEAM` | `none`                       | GH team gating approve/reject/delete; placeholder — production must override           |
+| `AUDIT_READ_AUTHZ_TEAM`   | `staff`                      | GH team (in `GH_REPO_ORG`) gating `GET /api/audit`; probed via the Universe-org client |
+| `GH_APP_ID`               | _(empty → repo feature off)_ | Apollo-11 GitHub App id (numeric string)                                               |
+| `GH_APP_INSTALLATION_ID`  | _(empty)_                    | App installation id (numeric string)                                                   |
+| `GH_APP_PRIVATE_KEY`      | _(empty)_                    | App private key PEM (PKCS#1 or PKCS#8)                                                 |
 
 `GH_APP_ID` / `GH_APP_INSTALLATION_ID` / `GH_APP_PRIVATE_KEY` are all-or-none: set all three to enable the `/api/repo*` self-service repo-creation feature, or none. The two ids must be digit-only strings — `validate()` rejects a malformed value at boot (a YAML int sealed in sops renders as scientific notation through Helm `quote`; seal them as strings).
 

internal/config/config.go

@@ -152,8 +152,9 @@ type RepoConfig struct {
 	// CreateAuthzTeam gates POST /api/repo. Default "staff". List, get,
 	// and templates are open to any GitHub bearer (no team gate).
 	// Both are slugs in Org.
-	CreateAuthzTeam  string
-	ApproveAuthzTeam string
+	CreateAuthzTeam    string
+	ApproveAuthzTeam   string
+	AuditReadAuthzTeam string
 
 	App GitHubAppConfig
 }
@@ -185,6 +186,7 @@ const (
 	defaultRepoOrg                = "freeCodeCamp-Universe"
 	defaultRepoCreateAuthzTeam    = "staff"
 	defaultRepoApproveAuthzTeam   = "none"
+	defaultAuditReadAuthzTeam     = "staff"
 	defaultSentryTracesSampleRate = 0.2
 	defaultPGConnectRetryWindow   = 45 * time.Second
 )
@@ -226,9 +228,10 @@ func Load() (*Config, error) {
 			AuthzTeam: defaultRegistryAuthzTeam,
 		},
 		Repo: RepoConfig{
-			Org:              defaultRepoOrg,
-			CreateAuthzTeam:  defaultRepoCreateAuthzTeam,
-			ApproveAuthzTeam: defaultRepoApproveAuthzTeam,
+			Org:                defaultRepoOrg,
+			CreateAuthzTeam:    defaultRepoCreateAuthzTeam,
+			ApproveAuthzTeam:   defaultRepoApproveAuthzTeam,
+			AuditReadAuthzTeam: defaultAuditReadAuthzTeam,
 		},
 		Sentry: SentryConfig{
 			TracesSampleRate: defaultSentryTracesSampleRate,
@@ -320,6 +323,9 @@ func Load() (*Config, error) {
 	if v, ok := os.LookupEnv("REPO_APPROVE_AUTHZ_TEAM"); ok && v != "" {
 		cfg.Repo.ApproveAuthzTeam = v
 	}
+	if v, ok := os.LookupEnv("AUDIT_READ_AUTHZ_TEAM"); ok && v != "" {
+		cfg.Repo.AuditReadAuthzTeam = v
+	}
 	cfg.Repo.App.AppID = os.Getenv("GH_APP_ID")
 	cfg.Repo.App.InstallationID = os.Getenv("GH_APP_INSTALLATION_ID")
 	cfg.Repo.App.PrivateKeyPEM = os.Getenv("GH_APP_PRIVATE_KEY")
@@ -422,6 +428,9 @@ func (c *Config) validate() error {
 	if c.Repo.ApproveAuthzTeam == "" {
 		return fmt.Errorf("REPO_APPROVE_AUTHZ_TEAM must not be empty")
 	}
+	if strings.TrimSpace(c.Repo.AuditReadAuthzTeam) == "" {
+		return fmt.Errorf("AUDIT_READ_AUTHZ_TEAM must not be empty")
+	}
 	// Repo App credentials are optional (feature off when absent), but
 	// partial config is a misconfiguration — fail fast rather than boot
 	// a half-wired feature.

internal/handler/audit_list.go

@@ -39,6 +39,9 @@ func (h *Handlers) AuditList(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusServiceUnavailable, "audit_unavailable", "audit log is not configured")
 		return
 	}
+	if err := h.requireAuditReadAuthz(w, r); err != nil {
+		return
+	}
 	q := r.URL.Query()
 	f := pg.AuditFilter{
 		Site:   q.Get("site"),
@@ -81,3 +84,26 @@ func (h *Handlers) AuditList(w http.ResponseWriter, r *http.Request) {
 	}
 	writeJSON(w, http.StatusOK, rows)
 }
+
+func (h *Handlers) requireAuditReadAuthz(w http.ResponseWriter, r *http.Request) error {
+	if h.AuditReadAuthzTeam == "" {
+		writeError(w, http.StatusInternalServerError, "misconfigured", "audit authz team not set")
+		return errBadRequest
+	}
+	if h.RepoGH == nil {
+		writeError(w, http.StatusInternalServerError, "misconfigured", "universe-org github client not configured")
+		return errBadRequest
+	}
+	login := LoginFromContext(r.Context())
+	token := GitHubTokenFromContext(r.Context())
+	ok, err := h.RepoGH.AuthorizeForSite(r.Context(), token, login, []string{h.AuditReadAuthzTeam})
+	if err != nil {
+		writeGitHubProbeError(w, err)
+		return err
+	}
+	if !ok {
+		writeError(w, http.StatusForbidden, "user_unauthorized", "caller is not on the required team")
+		return errBadRequest
+	}
+	return nil
+}

internal/handler/audit_list_test.go

@@ -18,6 +18,8 @@ func auditHandlers(t *testing.T, fa *fakeAudit) *Handlers {
 	t.Helper()
 	h, _ := newTestHandlers(t, staffCallerGH(), standardSites(), newFakeR2())
 	h.Audit = fa
+	h.RepoGH = staffCallerGH()
+	h.AuditReadAuthzTeam = "staff"
 	return h
 }
 
@@ -67,17 +69,54 @@ func TestAuditList_InvalidLimit(t *testing.T) {
 	assert.Equal(t, "invalid_limit", env["error"]["code"])
 }
 
-func TestAuditList_AnyBearerNoTeamGate(t *testing.T) {
+func TestAuditList_NonStaffCallerIs403(t *testing.T) {
 	nobodyGH := &fakeGH{
 		tokenLogins: map[string]string{"tok": "nobody"},
 		userTeams:   map[string]map[string]bool{"nobody": {}},
 	}
 	h, _ := newTestHandlers(t, nobodyGH, standardSites(), newFakeR2())
 	h.Audit = &fakeAudit{}
+	h.RepoGH = nobodyGH
+	h.AuditReadAuthzTeam = "staff"
 
 	w := getAudit(h, "/api/audit")
-	require.Equal(t, http.StatusOK, w.Code, w.Body.String(),
-		"audit read is open to any authenticated GitHub bearer, no team gate")
+	require.Equal(t, http.StatusForbidden, w.Code, w.Body.String(),
+		"cross-tenant audit read must require Universe staff membership, not any GitHub bearer")
+	var env map[string]map[string]string
+	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &env))
+	assert.Equal(t, "user_unauthorized", env["error"]["code"])
+}
+
+func TestAuditList_StaffInBaseOrgButNotUniverseIs403(t *testing.T) {
+	baseOrgStaff := &fakeGH{
+		tokenLogins: map[string]string{"tok": "alice"},
+		userTeams:   map[string]map[string]bool{"alice": {"staff": true}},
+	}
+	universeNonStaff := &fakeGH{
+		tokenLogins: map[string]string{"tok": "alice"},
+		userTeams:   map[string]map[string]bool{"alice": {}},
+	}
+	h, _ := newTestHandlers(t, baseOrgStaff, standardSites(), newFakeR2())
+	h.Audit = &fakeAudit{}
+	h.RepoGH = universeNonStaff
+	h.AuditReadAuthzTeam = "staff"
+
+	w := getAudit(h, "/api/audit")
+	require.Equal(t, http.StatusForbidden, w.Code, w.Body.String(),
+		"gate must probe RepoGH (Universe org), not GH (base org): base-org staff who is not Universe staff is denied")
+}
+
+func TestAuditList_MisconfiguredNoRepoGHIs500(t *testing.T) {
+	h, _ := newTestHandlers(t, staffCallerGH(), standardSites(), newFakeR2())
+	h.Audit = &fakeAudit{}
+	h.AuditReadAuthzTeam = "staff"
+
+	w := getAudit(h, "/api/audit")
+	require.Equal(t, http.StatusInternalServerError, w.Code, w.Body.String(),
+		"RepoGH nil: Universe membership probe cannot run, gate must fail closed not fall open")
+	var env map[string]map[string]string
+	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &env))
+	assert.Equal(t, "misconfigured", env["error"]["code"])
 }
 
 func TestAuditList_NilStoreIs503(t *testing.T) {

internal/handler/handler.go

@@ -144,6 +144,7 @@ type Handlers struct {
 	RepoOrg              string
 	RepoCreateAuthzTeam  string
 	RepoApproveAuthzTeam string
+	AuditReadAuthzTeam   string
 	NewDeployID          func(sha string) string
 	Now                  func() time.Time
 	PublicURLForSite     func(site, mode string) string // e.g. preview → "https://www.preview.freecode.camp"