Fix JWT Scope Security issue (#182)

Resolves impact from CVE-2026-52855

Author: parkervcp

router/router.go

@@ -1,6 +1,8 @@
 package router
 
 import (
+	"regexp"
+
 	"emperror.dev/errors"
 	"github.com/apex/log"
 	"github.com/gin-gonic/gin"
@@ -10,6 +12,8 @@ import (
 	wserver "github.com/pelican-dev/wings/server"
 )
 
+var tokenRegex = regexp.MustCompile(`([?|&]token=)([^&]+)($|&)`)
+
 // Configure configures the routing infrastructure for this daemon instance.
 func Configure(m *wserver.Manager, client remote.Client) *gin.Engine {
 	gin.SetMode("release")
@@ -33,7 +37,9 @@ func Configure(m *wserver.Manager, client remote.Client) *gin.Engine {
 			"status":     params.StatusCode,
 			"latency":    params.Latency,
 			"request_id": params.Keys["request_id"],
-		}).Debugf("%s %s", params.MethodColor()+params.Method+params.ResetColor(), params.Path)
+		}).Debugf("%s %s",
+			params.Method,
+			tokenRegex.ReplaceAllString(params.Path, "$1***$3"))
 
 		return ""
 	}))

router/router_download.go

@@ -28,7 +28,7 @@ func getDownloadBackup(c *gin.Context) {
 	}
 
 	// Get the server using the UUID from the token.
-	if _, ok := manager.Get(token.ServerUuid); !ok || !token.IsUniqueRequest() {
+	if _, ok := manager.Get(token.ServerUuid); !ok || !token.IsUniqueRequest() || !token.HasScope(tokens.BackupDownload) {
 		c.AbortWithStatusJSON(http.StatusNotFound, gin.H{
 			"error": "The requested resource was not found on this server.",
 		})
@@ -82,7 +82,7 @@ func getDownloadFile(c *gin.Context) {
 	}
 
 	s, ok := manager.Get(token.ServerUuid)
-	if !ok || !token.IsUniqueRequest() {
+	if !ok || !token.IsUniqueRequest() || !token.HasScope(tokens.FileDownload) {
 		c.AbortWithStatusJSON(http.StatusNotFound, gin.H{
 			"error": "The requested resource was not found on this server.",
 		})

router/router_server_files.go

@@ -240,7 +240,7 @@ func postServerDeleteFiles(c *gin.Context) {
 				return s.Filesystem().SafeDeleteRecursively(pi)
 			}
 		})
-		
+
 	}
 
 	if err := g.Wait(); err != nil {
@@ -599,7 +599,7 @@ func postServerUploadFiles(c *gin.Context) {
 	}
 
 	s, ok := manager.Get(token.ServerUuid)
-	if !ok || !token.IsUniqueRequest() {
+	if !ok || !token.IsUniqueRequest() || !token.HasScope(tokens.FileUpload) {
 		c.AbortWithStatusJSON(http.StatusNotFound, gin.H{
 			"error": "The requested resource was not found on this server.",
 		})

router/router_transfer.go

@@ -32,7 +32,7 @@ func postTransfers(c *gin.Context) {
 	if len(auth) != 2 || auth[0] != "Bearer" {
 		c.Header("WWW-Authenticate", "Bearer")
 		c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
-			"error": "The required authorization heads were not present in the request.",
+			"error": "The required authorization headers were not present in the request.",
 		})
 		return
 	}
@@ -43,6 +43,11 @@ func postTransfers(c *gin.Context) {
 		return
 	}
 
+	if !token.HasScope(tokens.ServerTransfer) {
+		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "Forbidden."})
+		return
+	}
+
 	manager := middleware.ExtractManager(c)
 	u, err := uuid.Parse(token.Subject)
 	if err != nil {
@@ -142,14 +147,13 @@ func postTransfers(c *gin.Context) {
 		return
 	}
 
-
 	// Used to read the file and checksum from the request body.
 	mr := multipart.NewReader(c.Request.Body, params["boundary"])
 
 	var (
-		hasArchive              bool
-		archiveChecksum         string
-		archiveChecksumReceived string
+		hasArchive                bool
+		archiveChecksum           string
+		archiveChecksumReceived   string
 		backupChecksumsCalculated = make(map[string]string)
 		backupChecksumsReceived   = make(map[string]string)
 	)
@@ -208,7 +212,7 @@ out:
 
 			case name == "install_logs":
 				trnsfr.Log().Debug("received install logs")
-				
+
 				// Create install log directory if it doesn't exist
 				cfg := config.Get()
 				installLogDir := filepath.Join(cfg.System.LogDirectory, "install")
@@ -217,33 +221,33 @@ out:
 					trnsfr.Log().WithError(err).Warn("failed to create install log directory, skipping")
 					break
 				}
-				
+
 				// Use the correct install log path with server UUID
 				installLogPath := filepath.Join(installLogDir, trnsfr.Server.ID()+".log")
-				
+
 				// Create the install log file
 				installLogFile, err := os.Create(installLogPath)
 				if err != nil {
 					// Don't fail transfer for install logs, just log and continue
 					trnsfr.Log().WithError(err).Warn("failed to create install log file, skipping")
 					break
 				}
-				
+
 				// Stream the install logs to file
 				if _, err := io.Copy(installLogFile, p); err != nil {
 					installLogFile.Close()
 					// Don't fail transfer for install logs, just log and continue
 					trnsfr.Log().WithError(err).Warn("failed to stream install logs to file, skipping")
 					break
 				}
-				
+
 				if err := installLogFile.Close(); err != nil {
 					// Don't fail transfer for install logs, just log and continue
 					trnsfr.Log().WithError(err).Warn("failed to close install log file")
 				}
-				
+
 				trnsfr.Log().WithField("path", installLogPath).Debug("install logs saved successfully")
-				
+
 			case strings.HasPrefix(name, "backup_"):
 				backupName := strings.TrimPrefix(name, "backup_")
 				trnsfr.Log().WithField("backup", backupName).Debug("received backup file")

router/tokens/backup.go

@@ -10,6 +10,7 @@ type BackupPayload struct {
 	ServerUuid string `json:"server_uuid"`
 	BackupUuid string `json:"backup_uuid"`
 	UniqueId   string `json:"unique_id"`
+	Scoped
 }
 
 // Returns the JWT payload.

router/tokens/file.go

@@ -9,6 +9,7 @@ type FilePayload struct {
 	FilePath   string `json:"file_path"`
 	ServerUuid string `json:"server_uuid"`
 	UniqueId   string `json:"unique_id"`
+	Scoped
 }
 
 // Returns the JWT payload.

router/tokens/token.go

@@ -0,0 +1,33 @@
+package tokens
+
+import (
+	"strings"
+)
+
+type JwtScope string
+
+const (
+	Websocket      = JwtScope("websocket")
+	FileUpload     = JwtScope("file-upload")
+	FileDownload   = JwtScope("file-download")
+	BackupDownload = JwtScope("backup-download")
+	ServerTransfer = JwtScope("transfer")
+)
+
+type Scoped struct {
+	Scope string `json:"scope"`
+}
+
+func (s Scoped) Scopes() []string {
+	return strings.Split(s.Scope, " ")
+}
+
+func (s Scoped) HasScope(scope JwtScope) bool {
+	for _, v := range s.Scopes() {
+		if v == string(scope) {
+			return true
+		}
+	}
+
+	return false
+}

router/tokens/transfer.go

@@ -6,6 +6,7 @@ import (
 
 type TransferPayload struct {
 	jwt.Payload
+	Scoped
 }
 
 // GetPayload returns the JWT payload.

router/tokens/upload.go

@@ -10,6 +10,7 @@ type UploadPayload struct {
 	ServerUuid string `json:"server_uuid"`
 	UserUuid   string `json:"user_uuid"`
 	UniqueId   string `json:"unique_id"`
+	Scoped
 }
 
 // Returns the JWT payload.

router/tokens/websocket.go

@@ -52,6 +52,7 @@ func DenyForServer(s string, u string) {
 type WebsocketPayload struct {
 	jwt.Payload
 	sync.RWMutex
+	Scoped
 
 	UserUUID    string   `json:"user_uuid"`
 	ServerUUID  string   `json:"server_uuid"`