copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(auth): add scope-based access control to all existing routes (TRU-149)

Browse Source 
Adds a scope-based access control layer to all 81 existing API routes.
Sits alongside existing session-cookie auth (does not replace it).

What this PR does:
- Audits every existing route and documents required scope per route
  (see documentation/auth/route-scope-audit.md)
- Adds classes/auth/scope.php with 10 scope constants and role→scope defaults
- Adds classes/auth/scope_middleware.php with requireScope/requireAnyScope/requireRole
- Applies require*() calls to all 81 existing routes
- Adds ScopeMiddlewareTest (unit, 178 lines) and RouteScopeTest (integration, 212 lines)

Coexistence note:
This branch's classes/auth/scope.php is a stub that will be replaced
by classes/auth/scope_registry.php (from TRU-145 / PR #396) when that
PR merges first. The two have compatible APIs.

Refs: TRU-149
This commit is contained in:
OpenClaw
2026-08-17 11:43:13 +00:00
parent 935b2d58ce
commit 51a87655d6
86 changed files with 1872 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/superuserSecurityRoute.php
+14
View File
@@ -7,6 +7,9 @@ use classes\security_policy_service;
use Throwable;
use traits\route_t;
use app\auth\Scope;
use app\auth\ScopeMiddleware;
require_once WD . '/classes/security_policy_service.php';
class superuserSecurityRoute
@@ -16,6 +19,7 @@ class superuserSecurityRoute
public function run(): void
{
$this->get('/superuser/system/security/summary', function () {
ScopeMiddleware::requireScope(Scope::SUPERUSER_READ, '/superuser/system/security/summary');
global $response;
$this->requireClassicSuperuserPermission('superuser_security_view');
@@ -25,6 +29,7 @@ class superuserSecurityRoute
]);
$this->get('/superuser/system/security/settings', function () {
ScopeMiddleware::requireScope(Scope::SUPERUSER_READ, '/superuser/system/security/settings');
global $response;
$this->requireClassicSuperuserPermission('superuser_security_view');
@@ -35,6 +40,7 @@ class superuserSecurityRoute
]);
$this->patch('/superuser/system/security/settings', function () {
ScopeMiddleware::requireScope(Scope::SUPERUSER_WRITE, '/superuser/system/security/settings');
global $response;
$this->requireClassicSuperuserPermission('superuser_security_settings_manage');
@@ -51,6 +57,7 @@ class superuserSecurityRoute
]);
$this->get('/superuser/system/security/firewall-rules', function () {
ScopeMiddleware::requireScope(Scope::SUPERUSER_READ, '/superuser/system/security/firewall-rules');
global $response;
$this->requireClassicSuperuserPermission('superuser_security_view');
@@ -60,6 +67,7 @@ class superuserSecurityRoute
]);
$this->post('/superuser/system/security/firewall-rules', function () {
ScopeMiddleware::requireScope(Scope::SUPERUSER_WRITE, '/superuser/system/security/firewall-rules');
global $response;
$this->requireClassicSuperuserPermission('superuser_security_firewall_manage');
@@ -76,6 +84,7 @@ class superuserSecurityRoute
]);
$this->patch('/superuser/system/security/firewall-rules/{id}', function () {
ScopeMiddleware::requireScope(Scope::SUPERUSER_WRITE, '/superuser/system/security/firewall-rules/{id}');
global $response;
$this->requireClassicSuperuserPermission('superuser_security_firewall_manage');
@@ -93,6 +102,7 @@ class superuserSecurityRoute
]);
$this->delete('/superuser/system/security/firewall-rules/{id}', function () {
ScopeMiddleware::requireScope(Scope::SUPERUSER_WRITE, '/superuser/system/security/firewall-rules/{id}');
global $response;
$this->requireClassicSuperuserPermission('superuser_security_firewall_manage');
@@ -109,6 +119,7 @@ class superuserSecurityRoute
]);
$this->get('/superuser/system/security/incidents', function () {
ScopeMiddleware::requireScope(Scope::SUPERUSER_READ, '/superuser/system/security/incidents');
global $response;
$this->requireClassicSuperuserPermission('superuser_security_view');
@@ -118,6 +129,7 @@ class superuserSecurityRoute
]);
$this->get('/superuser/system/security/incidents/{id}', function () {
ScopeMiddleware::requireScope(Scope::SUPERUSER_READ, '/superuser/system/security/incidents/{id}');
global $response;
$this->requireClassicSuperuserPermission('superuser_security_view');
@@ -131,6 +143,7 @@ class superuserSecurityRoute
]);
$this->patch('/superuser/system/security/incidents/{id}', function () {
ScopeMiddleware::requireScope(Scope::SUPERUSER_WRITE, '/superuser/system/security/incidents/{id}');
global $response;
$this->requireClassicSuperuserPermission('superuser_security_incidents_manage');
@@ -148,6 +161,7 @@ class superuserSecurityRoute
]);
$this->post('/superuser/system/security/incidents/{id}/notes', function () {
ScopeMiddleware::requireScope(Scope::SUPERUSER_WRITE, '/superuser/system/security/incidents/{id}/notes');
global $response;
$this->requireClassicSuperuserPermission('superuser_security_incidents_manage');