admin/0pt
5
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): require auth on GET /api/orders and GET /api/admin/metrics #11

Merged
admin merged 1 commits from security/auth-gate-anonymous-api-routes into main 2026-08-11 09:35:48 +00:00
Conversation 0 Commits 1 Files Changed 4
+155 -5
1 Commits
Author SHA1 Message Date
adminandClaude Sonnet 5 15a0dbe3b1 fix(security): require auth on GET /api/orders and GET /api/admin/metrics
Security Scan (SIAX Cloud) / security (pull_request) Successful in 24s
Details
CI (SIAX Cloud) / security (pull_request) Successful in 25s
Details
CI (SIAX Cloud) / quality (pull_request) Successful in 40s
Details
CI (SIAX Cloud) / security (push) Successful in 22s
Details
Security Scan (SIAX Cloud) / security (push) Successful in 20s
Details
CI (SIAX Cloud) / quality (push) Successful in 39s
Details 
A live compliance audit against 0pt.app confirmed both endpoints returned
HTTP 200 with zero authentication -- the full order queue and financial
pipeline aggregates (deposit/pipeline totals) were readable by anyone.

Root cause: middleware.ts's matcher only covers /api/0pt/:path*, by design
("does NOT touch ... the unrelated payment/order APIs"), so nothing upstream
of these two handlers ever verified the caller.

Fix: both GET handlers now call the same fail-closed Zitadel verifier
/api/0pt/* relies on (resolveAuthContext, src/auth/context.ts) directly, via
a new thin wrapper (src/auth/require-route-auth.ts) that maps a rejected
decision to the same 401/403 JSON shape middleware.ts already returns. The
wrapper re-verifies the bearer token itself rather than trusting any
x-0pt-verified-* header on the request, since middleware never runs in front
of these routes to overwrite a client-supplied one.

POST /api/orders (anonymous draft/quote creation before the deposit-payment
step) is intentionally left as-is -- only the read paths that leaked data are
gated. Tracked as part of docs/compliance/BACKLOG.md P0-3.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-08-11 04:06:13 +02:00