From 51475ed56471cbf28baf3953125b0f7d725db79b Mon Sep 17 00:00:00 2001 From: Umberto Sgueglia Date: Mon, 15 Jun 2026 10:12:52 +0200 Subject: [PATCH 1/5] fix: restore scopes Signed-off-by: Umberto Sgueglia --- backend/src/api/public/v1/index.ts | 8 +++----- backend/src/api/public/v1/packages/index.ts | 14 +++++--------- 2 files changed, 8 insertions(+), 14 deletions(-) diff --git a/backend/src/api/public/v1/index.ts b/backend/src/api/public/v1/index.ts index c83286506f..9179bca95d 100644 --- a/backend/src/api/public/v1/index.ts +++ b/backend/src/api/public/v1/index.ts @@ -5,11 +5,10 @@ import { NotFoundError } from '@crowd/common' import { createRateLimiter } from '@/api/apiRateLimiter' import { safeWrap } from '@/middlewares/errorMiddleware' -// TODO: restore once read:stewardships is added to Auth0 staging tenant -// import { SCOPES } from '@/security/scopes' +import { SCOPES } from '@/security/scopes' import { AUTH0_CONFIG } from '../../../conf' import { oauth2Middleware } from '../middlewares/oauth2Middleware' -// import { requireScopes } from '../middlewares/requireScopes' +import { requireScopes } from '../middlewares/requireScopes' import { staticApiKeyMiddleware } from '../middlewares/staticApiKeyMiddleware' import { memberOrganizationAffiliationsRouter } from './affiliations' @@ -35,8 +34,7 @@ export function v1Router(): Router { /^\/packages:batch-stewardship\/?$/, oauth2Middleware(AUTH0_CONFIG), packagesRateLimiter, - // TODO: restore once read:stewardships is added to Auth0 staging tenant - // requireScopes([SCOPES.READ_STEWARDSHIPS]), + requireScopes([SCOPES.READ_STEWARDSHIPS]), safeWrap(batchGetStewardship), ) router.use('/packages', oauth2Middleware(AUTH0_CONFIG), packagesRouter()) diff --git a/backend/src/api/public/v1/packages/index.ts b/backend/src/api/public/v1/packages/index.ts index 99806f6d10..e2ec05bb5c 100644 --- a/backend/src/api/public/v1/packages/index.ts +++ b/backend/src/api/public/v1/packages/index.ts @@ -1,11 +1,10 @@ import { Router } from 'express' import { createRateLimiter } from '@/api/apiRateLimiter' -// TODO: restore once read:packages + read:stewardships are added to Auth0 staging tenant -// import { requireScopes } from '@/api/public/middlewares/requireScopes' +import { requireScopes } from '@/api/public/middlewares/requireScopes' import { safeWrap } from '@/middlewares/errorMiddleware' -// import { SCOPES } from '@/security/scopes' +import { SCOPES } from '@/security/scopes' import { getPackage } from './getPackage' import { getPackagesMetrics } from './getPackagesMetrics' import { listPackages } from './listPackages' @@ -24,22 +23,19 @@ export function packagesRouter(): Router { router.get( '/', - // TODO: restore once read:packages + read:stewardships are added to Auth0 staging tenant - // requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), safeWrap(listPackages), ) router.get( '/metrics', - // TODO: restore once read:packages + read:stewardships are added to Auth0 staging tenant - // requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), safeWrap(getPackagesMetrics), ) router.get( '/detail', - // TODO: restore once read:packages + read:stewardships are added to Auth0 staging tenant - // requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), safeWrap(getPackage), ) From ad1b2754188fcda05d59139af12210b6c63de6b8 Mon Sep 17 00:00:00 2001 From: Umberto Sgueglia Date: Mon, 15 Jun 2026 11:39:03 +0200 Subject: [PATCH 2/5] fix: restore scopes Signed-off-by: Umberto Sgueglia --- backend/src/api/public/v1/index.ts | 4 ++-- backend/src/api/public/v1/packages/index.ts | 23 +++++---------------- 2 files changed, 7 insertions(+), 20 deletions(-) diff --git a/backend/src/api/public/v1/index.ts b/backend/src/api/public/v1/index.ts index 9179bca95d..1dd4501886 100644 --- a/backend/src/api/public/v1/index.ts +++ b/backend/src/api/public/v1/index.ts @@ -4,8 +4,8 @@ import { NotFoundError } from '@crowd/common' import { createRateLimiter } from '@/api/apiRateLimiter' import { safeWrap } from '@/middlewares/errorMiddleware' - import { SCOPES } from '@/security/scopes' + import { AUTH0_CONFIG } from '../../../conf' import { oauth2Middleware } from '../middlewares/oauth2Middleware' import { requireScopes } from '../middlewares/requireScopes' @@ -34,7 +34,7 @@ export function v1Router(): Router { /^\/packages:batch-stewardship\/?$/, oauth2Middleware(AUTH0_CONFIG), packagesRateLimiter, - requireScopes([SCOPES.READ_STEWARDSHIPS]), + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'all'), safeWrap(batchGetStewardship), ) router.use('/packages', oauth2Middleware(AUTH0_CONFIG), packagesRouter()) diff --git a/backend/src/api/public/v1/packages/index.ts b/backend/src/api/public/v1/packages/index.ts index e2ec05bb5c..14f55f424e 100644 --- a/backend/src/api/public/v1/packages/index.ts +++ b/backend/src/api/public/v1/packages/index.ts @@ -3,8 +3,8 @@ import { Router } from 'express' import { createRateLimiter } from '@/api/apiRateLimiter' import { requireScopes } from '@/api/public/middlewares/requireScopes' import { safeWrap } from '@/middlewares/errorMiddleware' - import { SCOPES } from '@/security/scopes' + import { getPackage } from './getPackage' import { getPackagesMetrics } from './getPackagesMetrics' import { listPackages } from './listPackages' @@ -20,24 +20,11 @@ export function packagesRouter(): Router { const router = Router() router.use(rateLimiter) + router.use(requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'all')) - router.get( - '/', - requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), - safeWrap(listPackages), - ) - - router.get( - '/metrics', - requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), - safeWrap(getPackagesMetrics), - ) - - router.get( - '/detail', - requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), - safeWrap(getPackage), - ) + router.get('/', safeWrap(listPackages)) + router.get('/metrics', safeWrap(getPackagesMetrics)) + router.get('/detail', safeWrap(getPackage)) return router } From 79ac845a2a3ee4223c56095051405279b9ab418d Mon Sep 17 00:00:00 2001 From: Umberto Sgueglia Date: Fri, 19 Jun 2026 11:34:38 +0200 Subject: [PATCH 3/5] feat: re-enable scopes Signed-off-by: Umberto Sgueglia --- backend/src/api/public/v1/akrites/index.ts | 48 +++++-------------- backend/src/api/public/v1/index.ts | 2 +- backend/src/api/public/v1/packages/index.ts | 2 +- .../src/api/public/v1/stewardships/index.ts | 39 ++++----------- backend/src/security/scopes.ts | 1 + 5 files changed, 23 insertions(+), 69 deletions(-) diff --git a/backend/src/api/public/v1/akrites/index.ts b/backend/src/api/public/v1/akrites/index.ts index 455626b95d..be1569ad30 100644 --- a/backend/src/api/public/v1/akrites/index.ts +++ b/backend/src/api/public/v1/akrites/index.ts @@ -1,11 +1,10 @@ import { Router } from 'express' import { createRateLimiter } from '@/api/apiRateLimiter' +import { requireScopes } from '@/api/public/middlewares/requireScopes' import { safeWrap } from '@/middlewares/errorMiddleware' +import { SCOPES } from '@/security/scopes' -// TODO: restore once scopes are added to Auth0 staging tenant -// import { requireScopes } from '@/api/public/middlewares/requireScopes' -// import { SCOPES } from '@/security/scopes' import { activityFeedHandler } from '../ossprey/activityFeed' import { metricsHandler } from '../ossprey/metrics' import { packageListHandler } from '../ossprey/packageList' @@ -37,34 +36,29 @@ export function akritesRouter(): Router { router.post( /^\/packages:batch-stewardship\/?$/, rateLimiter, - // TODO: restore once read:packages + read:stewardships are added to Auth0 staging tenant - // requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), safeWrap(batchGetStewardship), ) const packagesSubRouter = Router() packagesSubRouter.use(rateLimiter) packagesSubRouter.get( '/metrics', - // TODO: restore once read:packages + read:stewardships are added to Auth0 staging tenant - // requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), safeWrap(getPackagesMetrics), ) packagesSubRouter.get( '/detail', - // TODO: restore once read:packages + read:stewardships are added to Auth0 staging tenant - // requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), safeWrap(getPackage), ) packagesSubRouter.get( '/advisories', - // TODO: restore once read:packages + read:stewardships are added to Auth0 staging tenant - // requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), safeWrap(getPackageAdvisories), ) packagesSubRouter.get( '/history', - // TODO: restore once read:packages + read:stewardships are added to Auth0 staging tenant - // requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), safeWrap(getPackageHistory), ) router.use('/packages', packagesSubRouter) @@ -72,30 +66,10 @@ export function akritesRouter(): Router { // --- stewardships --- const stewardshipsSubRouter = Router() stewardshipsSubRouter.use(rateLimiter) - stewardshipsSubRouter.post( - '/open', - // TODO: restore once write:stewardships is added to Auth0 staging tenant - // requireScopes([SCOPES.WRITE_STEWARDSHIPS]), - safeWrap(openStewardship), - ) - stewardshipsSubRouter.post( - '/:id/assign', - // TODO: restore once write:stewardships is added to Auth0 staging tenant - // requireScopes([SCOPES.WRITE_STEWARDSHIPS]), - safeWrap(assignStewardHandler), - ) - stewardshipsSubRouter.post( - '/:id/escalate', - // TODO: restore once write:stewardships is added to Auth0 staging tenant - // requireScopes([SCOPES.WRITE_STEWARDSHIPS]), - safeWrap(escalateHandler), - ) - stewardshipsSubRouter.patch( - '/:id/status', - // TODO: restore once write:stewardships is added to Auth0 staging tenant - // requireScopes([SCOPES.WRITE_STEWARDSHIPS]), - safeWrap(updateStatusHandler), - ) + stewardshipsSubRouter.post('/open', requireScopes([SCOPES.WRITE_STEWARDSHIPS]), safeWrap(openStewardship)) + stewardshipsSubRouter.post('/:id/assign', requireScopes([SCOPES.WRITE_STEWARDSHIPS]), safeWrap(assignStewardHandler)) + stewardshipsSubRouter.post('/:id/escalate', requireScopes([SCOPES.WRITE_STEWARDSHIPS]), safeWrap(escalateHandler)) + stewardshipsSubRouter.patch('/:id/status', requireScopes([SCOPES.WRITE_STEWARDSHIPS]), safeWrap(updateStatusHandler)) router.use('/stewardships', stewardshipsSubRouter) return router diff --git a/backend/src/api/public/v1/index.ts b/backend/src/api/public/v1/index.ts index 1dd4501886..44731a4e14 100644 --- a/backend/src/api/public/v1/index.ts +++ b/backend/src/api/public/v1/index.ts @@ -34,7 +34,7 @@ export function v1Router(): Router { /^\/packages:batch-stewardship\/?$/, oauth2Middleware(AUTH0_CONFIG), packagesRateLimiter, - requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'all'), + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), safeWrap(batchGetStewardship), ) router.use('/packages', oauth2Middleware(AUTH0_CONFIG), packagesRouter()) diff --git a/backend/src/api/public/v1/packages/index.ts b/backend/src/api/public/v1/packages/index.ts index 14f55f424e..2dafc02a08 100644 --- a/backend/src/api/public/v1/packages/index.ts +++ b/backend/src/api/public/v1/packages/index.ts @@ -20,7 +20,7 @@ export function packagesRouter(): Router { const router = Router() router.use(rateLimiter) - router.use(requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'all')) + router.use(requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any')) router.get('/', safeWrap(listPackages)) router.get('/metrics', safeWrap(getPackagesMetrics)) diff --git a/backend/src/api/public/v1/stewardships/index.ts b/backend/src/api/public/v1/stewardships/index.ts index 0646c58116..c1d2398336 100644 --- a/backend/src/api/public/v1/stewardships/index.ts +++ b/backend/src/api/public/v1/stewardships/index.ts @@ -1,11 +1,10 @@ import { Router } from 'express' import { createRateLimiter } from '@/api/apiRateLimiter' -// TODO: restore once write:stewardships is added to Auth0 staging tenant -// import { requireScopes } from '@/api/public/middlewares/requireScopes' +import { requireScopes } from '@/api/public/middlewares/requireScopes' import { safeWrap } from '@/middlewares/errorMiddleware' +import { SCOPES } from '@/security/scopes' -// import { SCOPES } from '@/security/scopes' import { assignStewardHandler } from './assignSteward' import { escalateHandler } from './escalate' import { openStewardship } from './openStewardship' @@ -19,33 +18,13 @@ export function stewardshipsRouter(): Router { router.use(rateLimiter) - router.post( - '/', - // TODO: restore once write:stewardships is added to Auth0 staging tenant - // requireScopes([SCOPES.WRITE_STEWARDSHIPS]), - safeWrap(openStewardship), - ) - - router.put( - '/:id/steward', - // TODO: restore once write:stewardships is added to Auth0 staging tenant - // requireScopes([SCOPES.WRITE_STEWARDSHIPS]), - safeWrap(assignStewardHandler), - ) - - router.put( - '/:id/escalate', - // TODO: restore once write:stewardships is added to Auth0 staging tenant - // requireScopes([SCOPES.WRITE_STEWARDSHIPS]), - safeWrap(escalateHandler), - ) - - router.put( - '/:id/status', - // TODO: restore once write:stewardships is added to Auth0 staging tenant - // requireScopes([SCOPES.WRITE_STEWARDSHIPS]), - safeWrap(updateStatusHandler), - ) + router.post('/', requireScopes([SCOPES.WRITE_STEWARDSHIPS]), safeWrap(openStewardship)) + + router.put('/:id/steward', requireScopes([SCOPES.WRITE_STEWARDSHIPS]), safeWrap(assignStewardHandler)) + + router.put('/:id/escalate', requireScopes([SCOPES.WRITE_STEWARDSHIPS]), safeWrap(escalateHandler)) + + router.put('/:id/status', requireScopes([SCOPES.WRITE_STEWARDSHIPS]), safeWrap(updateStatusHandler)) return router } diff --git a/backend/src/security/scopes.ts b/backend/src/security/scopes.ts index 8ab8148556..5f7bd77f01 100644 --- a/backend/src/security/scopes.ts +++ b/backend/src/security/scopes.ts @@ -13,6 +13,7 @@ export const SCOPES = { READ_AFFILIATIONS: 'read:affiliations', READ_PACKAGES: 'read:packages', READ_STEWARDSHIPS: 'read:stewardships', + WRITE_STEWARDSHIPS: 'write:stewardships', } as const export type Scope = (typeof SCOPES)[keyof typeof SCOPES] From eb049bd1045a64678f243cf277fa95e77f4d103f Mon Sep 17 00:00:00 2001 From: Umberto Sgueglia Date: Fri, 19 Jun 2026 11:39:07 +0200 Subject: [PATCH 4/5] feat: lint Signed-off-by: Umberto Sgueglia --- backend/src/api/public/v1/akrites/index.ts | 24 +++++++++++++++---- .../src/api/public/v1/stewardships/index.ts | 12 ++++++++-- 2 files changed, 30 insertions(+), 6 deletions(-) diff --git a/backend/src/api/public/v1/akrites/index.ts b/backend/src/api/public/v1/akrites/index.ts index be1569ad30..6aa57ce2f3 100644 --- a/backend/src/api/public/v1/akrites/index.ts +++ b/backend/src/api/public/v1/akrites/index.ts @@ -66,10 +66,26 @@ export function akritesRouter(): Router { // --- stewardships --- const stewardshipsSubRouter = Router() stewardshipsSubRouter.use(rateLimiter) - stewardshipsSubRouter.post('/open', requireScopes([SCOPES.WRITE_STEWARDSHIPS]), safeWrap(openStewardship)) - stewardshipsSubRouter.post('/:id/assign', requireScopes([SCOPES.WRITE_STEWARDSHIPS]), safeWrap(assignStewardHandler)) - stewardshipsSubRouter.post('/:id/escalate', requireScopes([SCOPES.WRITE_STEWARDSHIPS]), safeWrap(escalateHandler)) - stewardshipsSubRouter.patch('/:id/status', requireScopes([SCOPES.WRITE_STEWARDSHIPS]), safeWrap(updateStatusHandler)) + stewardshipsSubRouter.post( + '/open', + requireScopes([SCOPES.WRITE_STEWARDSHIPS]), + safeWrap(openStewardship), + ) + stewardshipsSubRouter.post( + '/:id/assign', + requireScopes([SCOPES.WRITE_STEWARDSHIPS]), + safeWrap(assignStewardHandler), + ) + stewardshipsSubRouter.post( + '/:id/escalate', + requireScopes([SCOPES.WRITE_STEWARDSHIPS]), + safeWrap(escalateHandler), + ) + stewardshipsSubRouter.patch( + '/:id/status', + requireScopes([SCOPES.WRITE_STEWARDSHIPS]), + safeWrap(updateStatusHandler), + ) router.use('/stewardships', stewardshipsSubRouter) return router diff --git a/backend/src/api/public/v1/stewardships/index.ts b/backend/src/api/public/v1/stewardships/index.ts index c1d2398336..11fe360f71 100644 --- a/backend/src/api/public/v1/stewardships/index.ts +++ b/backend/src/api/public/v1/stewardships/index.ts @@ -20,11 +20,19 @@ export function stewardshipsRouter(): Router { router.post('/', requireScopes([SCOPES.WRITE_STEWARDSHIPS]), safeWrap(openStewardship)) - router.put('/:id/steward', requireScopes([SCOPES.WRITE_STEWARDSHIPS]), safeWrap(assignStewardHandler)) + router.put( + '/:id/steward', + requireScopes([SCOPES.WRITE_STEWARDSHIPS]), + safeWrap(assignStewardHandler), + ) router.put('/:id/escalate', requireScopes([SCOPES.WRITE_STEWARDSHIPS]), safeWrap(escalateHandler)) - router.put('/:id/status', requireScopes([SCOPES.WRITE_STEWARDSHIPS]), safeWrap(updateStatusHandler)) + router.put( + '/:id/status', + requireScopes([SCOPES.WRITE_STEWARDSHIPS]), + safeWrap(updateStatusHandler), + ) return router } From 06e1d4a1c22463fdee8f50df74186e221580fe87 Mon Sep 17 00:00:00 2001 From: Umberto Sgueglia Date: Fri, 19 Jun 2026 12:11:16 +0200 Subject: [PATCH 5/5] fix: revert to all Signed-off-by: Umberto Sgueglia --- backend/src/api/public/v1/akrites/index.ts | 36 +++++++++++++++------ backend/src/api/public/v1/index.ts | 2 +- backend/src/api/public/v1/ossprey/index.ts | 26 ++++++++++++--- backend/src/api/public/v1/packages/index.ts | 2 +- 4 files changed, 51 insertions(+), 15 deletions(-) diff --git a/backend/src/api/public/v1/akrites/index.ts b/backend/src/api/public/v1/akrites/index.ts index 6aa57ce2f3..9501b5ea13 100644 --- a/backend/src/api/public/v1/akrites/index.ts +++ b/backend/src/api/public/v1/akrites/index.ts @@ -24,41 +24,59 @@ const rateLimiter = createRateLimiter({ max: 60, windowMs: 60 * 1000 }) export function akritesRouter(): Router { const router = Router() - router.get('/metrics', safeWrap(metricsHandler)) + router.get( + '/metrics', + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'all'), + safeWrap(metricsHandler), + ) // /packages/scatter registered before router.use('/packages', ...) so Express evaluates this // explicit route first; without this ordering the sub-router would receive the request first // and call next() on no match, adding unnecessary overhead. - router.get('/packages/scatter', rateLimiter, safeWrap(packageScatterHandler)) - router.get('/packages', rateLimiter, safeWrap(packageListHandler)) - router.get('/activity', safeWrap(activityFeedHandler)) + router.get( + '/packages/scatter', + rateLimiter, + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'all'), + safeWrap(packageScatterHandler), + ) + router.get( + '/packages', + rateLimiter, + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'all'), + safeWrap(packageListHandler), + ) + router.get( + '/activity', + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'all'), + safeWrap(activityFeedHandler), + ) // --- packages --- router.post( /^\/packages:batch-stewardship\/?$/, rateLimiter, - requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'all'), safeWrap(batchGetStewardship), ) const packagesSubRouter = Router() packagesSubRouter.use(rateLimiter) packagesSubRouter.get( '/metrics', - requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'all'), safeWrap(getPackagesMetrics), ) packagesSubRouter.get( '/detail', - requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'all'), safeWrap(getPackage), ) packagesSubRouter.get( '/advisories', - requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'all'), safeWrap(getPackageAdvisories), ) packagesSubRouter.get( '/history', - requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'all'), safeWrap(getPackageHistory), ) router.use('/packages', packagesSubRouter) diff --git a/backend/src/api/public/v1/index.ts b/backend/src/api/public/v1/index.ts index 44731a4e14..1dd4501886 100644 --- a/backend/src/api/public/v1/index.ts +++ b/backend/src/api/public/v1/index.ts @@ -34,7 +34,7 @@ export function v1Router(): Router { /^\/packages:batch-stewardship\/?$/, oauth2Middleware(AUTH0_CONFIG), packagesRateLimiter, - requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any'), + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'all'), safeWrap(batchGetStewardship), ) router.use('/packages', oauth2Middleware(AUTH0_CONFIG), packagesRouter()) diff --git a/backend/src/api/public/v1/ossprey/index.ts b/backend/src/api/public/v1/ossprey/index.ts index 54bc75bc1b..3e718ab520 100644 --- a/backend/src/api/public/v1/ossprey/index.ts +++ b/backend/src/api/public/v1/ossprey/index.ts @@ -1,6 +1,8 @@ import { Router } from 'express' +import { requireScopes } from '@/api/public/middlewares/requireScopes' import { safeWrap } from '@/middlewares/errorMiddleware' +import { SCOPES } from '@/security/scopes' import { activityFeedHandler } from './activityFeed' import { metricsHandler } from './metrics' @@ -12,11 +14,27 @@ import { packageScatterHandler } from './packageScatter' export function osspreyRouter(): Router { const router = Router() - router.get('/metrics', safeWrap(metricsHandler)) + router.get( + '/metrics', + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'all'), + safeWrap(metricsHandler), + ) // /packages/scatter must be registered before /packages to avoid Express treating 'scatter' as a path param - router.get('/packages/scatter', safeWrap(packageScatterHandler)) - router.get('/packages', safeWrap(packageListHandler)) - router.get('/activity', safeWrap(activityFeedHandler)) + router.get( + '/packages/scatter', + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'all'), + safeWrap(packageScatterHandler), + ) + router.get( + '/packages', + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'all'), + safeWrap(packageListHandler), + ) + router.get( + '/activity', + requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'all'), + safeWrap(activityFeedHandler), + ) return router } diff --git a/backend/src/api/public/v1/packages/index.ts b/backend/src/api/public/v1/packages/index.ts index 2dafc02a08..14f55f424e 100644 --- a/backend/src/api/public/v1/packages/index.ts +++ b/backend/src/api/public/v1/packages/index.ts @@ -20,7 +20,7 @@ export function packagesRouter(): Router { const router = Router() router.use(rateLimiter) - router.use(requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'any')) + router.use(requireScopes([SCOPES.READ_PACKAGES, SCOPES.READ_STEWARDSHIPS], 'all')) router.get('/', safeWrap(listPackages)) router.get('/metrics', safeWrap(getPackagesMetrics))