Conversation
What was broken Project-level PM users in Work could see the project billing account name and id from Projects API, but the Billing Accounts API detail route could still reject their detail request before the project membership fallback could help. Root cause (if identifiable) The previous fix added a project membership fallback inside the billing-account detail service, but the detail route still only allowed billing-account reader roles. Users who only arrived as regular Topcoder project members could not reach that fallback, and the fallback did not constrain project membership to the roles allowed by Projects API for billing-account details. What was changed Allowed Topcoder User tokens through GET /billing-accounts/:billingAccountId only, then kept the service restricted to direct BillingAccountAccess grants or active project membership with a management or copilot project role on a project using the billing account. Project-scoped callers now also get line items filtered by active project membership. Updated README and Swagger authorization text to document the project-scoped detail behavior. Any added/updated tests No automated tests were added because billing-accounts-api-v6 does not define a test script. Validation was performed with pnpm lint and pnpm build; pnpm test reports that the test script is missing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What was broken
Project-level PM users in Work could see the project billing account name and id from Projects API, but the Billing Accounts API detail route could still reject their detail request before the project membership fallback could help.
Root cause (if identifiable)
The previous fix added a project membership fallback inside the billing-account detail service, but the detail route still only allowed billing-account reader roles. Users who only arrived as regular Topcoder project members could not reach that fallback, and the fallback did not constrain project membership to the roles allowed by Projects API for billing-account details.
What was changed
Allowed Topcoder User tokens through GET /billing-accounts/:billingAccountId only, then kept the service restricted to direct BillingAccountAccess grants or active project membership with a management or copilot project role on a project using the billing account. Project-scoped callers now also get line items filtered by active project membership.
Updated README and Swagger authorization text to document the project-scoped detail behavior.
Any added/updated tests
No automated tests were added because billing-accounts-api-v6 does not define a test script. Validation was performed with pnpm lint and pnpm build; pnpm test reports that the test script is missing.