Admin user routes are denied as unmapped before handler authorization #3

New issue

Open

opened 2026-09-06 19:12:31 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-06 19:12:31 +00:00

Owner

Reproduction

At server source 21461ee, bootstrap returned an administrator credential with scope ["admin"]. A read-only GET /auth/users with that bearer returned HTTP 403: {"status":"error","code":"access_denied",...}. The raw credential was not logged.

Source-supported cause

source/frontends/http-authorization.lisp:12-73 maps credential routes but omits /auth/users, /auth/users/:username/password, and /auth/password. authorize-http-route! converts a missing mapping to unmapped:http-route (:84-103). The closed capability vocabulary rejects that unknown action before handle-auth-list-users-route reaches its administrator check (http-auth-routes.lisp:208-213). An admin grant does not bypass an unknown action (authorization/policy.lisp:309-327).

ASDF loads http-authorization.lisp and its middleware before the late route mounts, so this is active behavior, not the older direct administrator-principal-p hypothesis.

Expected behavior

Authenticated administrator/admin-scoped principals should reach user administration handlers through explicit policy actions. Ordinary principals must remain denied. Do not bypass middleware or grant arbitrary scopes.

Regression criteria

GET/POST /auth/users and admin password reset map to principals:manage.
Self password change has an explicit authenticated action.
Unknown routes still fail closed.
A live read-only administrator request returns 200 without exposing credentials.

Research

STAR-RESEARCH-060 reassessment on research/star-bbpd-runtime-modernization; current source and tests override its earlier claims.

## Reproduction At server source `21461ee`, bootstrap returned an administrator credential with scope `["admin"]`. A read-only `GET /auth/users` with that bearer returned HTTP 403: `{"status":"error","code":"access_denied",...}`. The raw credential was not logged. ## Source-supported cause `source/frontends/http-authorization.lisp:12-73` maps credential routes but omits `/auth/users`, `/auth/users/:username/password`, and `/auth/password`. `authorize-http-route!` converts a missing mapping to `unmapped:http-route` (`:84-103`). The closed capability vocabulary rejects that unknown action before `handle-auth-list-users-route` reaches its administrator check (`http-auth-routes.lisp:208-213`). An `admin` grant does not bypass an unknown action (`authorization/policy.lisp:309-327`). ASDF loads `http-authorization.lisp` and its middleware before the late route mounts, so this is active behavior, not the older direct `administrator-principal-p` hypothesis. ## Expected behavior Authenticated administrator/admin-scoped principals should reach user administration handlers through explicit policy actions. Ordinary principals must remain denied. Do not bypass middleware or grant arbitrary scopes. ## Regression criteria - `GET`/`POST /auth/users` and admin password reset map to `principals:manage`. - Self password change has an explicit authenticated action. - Unknown routes still fail closed. - A live read-only administrator request returns 200 without exposing credentials. ## Research STAR-RESEARCH-060 reassessment on `research/star-bbpd-runtime-modernization`; current source and tests override its earlier claims.

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starintel-labs/starintel-server#3

No description provided.

Rows
Columns