Skip to content

Fix account takeover and privilege escalation paths in the API #302

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kaareal wants to merge 12 commits into from
Closed

Fix account takeover and privilege escalation paths in the API #302

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
cbfcce4
Lock down user roles, contact fields, product writes and docs editing
kaareal Sep 18, 2026
2bbad12
Harden password reset, TOTP login and OAuth account linking
kaareal Sep 18, 2026
9e74e7d
Mark email verified on invite accept and password reset
kaareal Sep 18, 2026
3b68168
Clear pre-verification logins on password reset and invite accept
kaareal Sep 18, 2026
d6e7b0b
Verify email only when the OTP was delivered by email
kaareal Sep 18, 2026
3c3d70f
Require exactly one of email or phone on code login routes
kaareal Sep 22, 2026
459a754
Send the login code to the identifier that named the account
kaareal Sep 22, 2026
86479da
Merge remote-tracking branch 'origin/master' into security/api-fixes
kaareal Sep 22, 2026
2c74816
Regenerate OpenAPI definition
kaareal Sep 22, 2026
89ab5de
Distinguish the two identity validation failures
kaareal Sep 22, 2026
6e1859e
Merge remote-tracking branch 'origin/master' into security/api-fixes
kaareal Sep 23, 2026
40f3412
Merge remote-tracking branch 'origin/master' into security/api-fixes
kaareal Sep 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
167 changes: 89 additions & 78 deletions services/api/openapi.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,6 @@
},
"channel": {
"type": "string",
"default": "email",
"enum": [
"email",
"sms"
Expand Down Expand Up @@ -878,6 +877,40 @@
"required": [],
"additionalProperties": false
},
"createdAt": {
"anyOf": [
{
"$ref": "#/components/schemas/DateTime"
},
{
"type": "array",
"items": {
"$ref": "#/components/schemas/DateTime"
}
},
{
"$ref": "#/components/schemas/DateRange"
}
],
"description": "Allows searching by a date, array of dates, or a range."
},
"updatedAt": {
"anyOf": [
{
"$ref": "#/components/schemas/DateTime"
},
{
"type": "array",
"items": {
"$ref": "#/components/schemas/DateTime"
}
},
{
"$ref": "#/components/schemas/DateRange"
}
],
"description": "Allows searching by a date, array of dates, or a range."
},
"roles": {
"type": "object",
"properties": {
Expand Down Expand Up @@ -963,40 +996,6 @@
"isTester": {
"type": "boolean"
},
"createdAt": {
"anyOf": [
{
"$ref": "#/components/schemas/DateTime"
},
{
"type": "array",
"items": {
"$ref": "#/components/schemas/DateTime"
}
},
{
"$ref": "#/components/schemas/DateRange"
}
],
"description": "Allows searching by a date, array of dates, or a range."
},
"updatedAt": {
"anyOf": [
{
"$ref": "#/components/schemas/DateTime"
},
{
"type": "array",
"items": {
"$ref": "#/components/schemas/DateTime"
}
},
{
"$ref": "#/components/schemas/DateRange"
}
],
"description": "Allows searching by a date, array of dates, or a range."
},
"include": {
"$ref": "#/components/schemas/Includes"
},
Expand Down Expand Up @@ -1463,7 +1462,11 @@
{
"bearerAuth": []
}
]
],
"x-permissions": {
"endpoint": "products",
"permission": "write"
}
}
},
"/1/products/:id": {
Expand Down Expand Up @@ -1562,7 +1565,11 @@
{
"bearerAuth": []
}
]
],
"x-permissions": {
"endpoint": "products",
"permission": "write"
}
},
"delete": {
"summary": "Delete product",
Expand All @@ -1581,7 +1588,11 @@
{
"bearerAuth": []
}
]
],
"x-permissions": {
"endpoint": "products",
"permission": "write"
}
}
},
"/1/products/search": {
Expand Down Expand Up @@ -3894,6 +3905,40 @@
"required": [],
"additionalProperties": false
},
"createdAt": {
"anyOf": [
{
"$ref": "#/components/schemas/DateTime"
},
{
"type": "array",
"items": {
"$ref": "#/components/schemas/DateTime"
}
},
{
"$ref": "#/components/schemas/DateRange"
}
],
"description": "Allows searching by a date, array of dates, or a range."
},
"updatedAt": {
"anyOf": [
{
"$ref": "#/components/schemas/DateTime"
},
{
"type": "array",
"items": {
"$ref": "#/components/schemas/DateTime"
}
},
{
"$ref": "#/components/schemas/DateRange"
}
],
"description": "Allows searching by a date, array of dates, or a range."
},
"roles": {
"type": "object",
"properties": {
Expand Down Expand Up @@ -3979,40 +4024,6 @@
"isTester": {
"type": "boolean"
},
"createdAt": {
"anyOf": [
{
"$ref": "#/components/schemas/DateTime"
},
{
"type": "array",
"items": {
"$ref": "#/components/schemas/DateTime"
}
},
{
"$ref": "#/components/schemas/DateRange"
}
],
"description": "Allows searching by a date, array of dates, or a range."
},
"updatedAt": {
"anyOf": [
{
"$ref": "#/components/schemas/DateTime"
},
{
"type": "array",
"items": {
"$ref": "#/components/schemas/DateTime"
}
},
{
"$ref": "#/components/schemas/DateRange"
}
],
"description": "Allows searching by a date, array of dates, or a range."
},
"include": {
"$ref": "#/components/schemas/Includes"
},
Expand Down Expand Up @@ -4995,6 +5006,12 @@
"additionalProperties": false
}
},
"createdAt": {
"$ref": "#/components/schemas/DateTime"
},
"updatedAt": {
"$ref": "#/components/schemas/DateTime"
},
"roles": {
"type": "array",
"items": {
Expand Down Expand Up @@ -5023,12 +5040,6 @@
},
"isTester": {
"type": "boolean"
},
"createdAt": {
"$ref": "#/components/schemas/DateTime"
},
"updatedAt": {
"$ref": "#/components/schemas/DateTime"
}
},
"required": [
Expand Down
73 changes: 52 additions & 21 deletions services/api/src/models/definitions/user.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,12 @@
"writeAccess": [
"admin",
"superAdmin"
],
"readAccess": [
"self",
"viewer",
"admin",
"superAdmin"
]
},
"emailVerified": {
Expand All @@ -30,6 +36,12 @@
"writeAccess": [
"admin",
"superAdmin"
],
"readAccess": [
"self",
"viewer",
"admin",
"superAdmin"
]
},
"phoneVerified": {
Expand Down Expand Up @@ -71,29 +83,44 @@
}
}
],
"roles": [
{
"role": {
"type": "String",
"required": true
},
"scope": {
"type": "String",
"required": true,
"enum": [
"global",
"organization"
]
},
"scopeRef": {
"type": "ObjectId",
"ref": "Organization"
"$staff": {
"type": "Scope",
"readAccess": [
"self",
"viewer",
"admin",
"superAdmin"
],
"writeAccess": [
"admin",
"superAdmin"
],
"attributes": {
"roles": [
{
"role": {
"type": "String",
"required": true
},
"scope": {
"type": "String",
"required": true,
"enum": [
"global",
"organization"
]
},
"scopeRef": {
"type": "ObjectId",
"ref": "Organization"
}
}
],
"isTester": {
"type": "Boolean",
"default": false
}
}
],
"isTester": {
"type": "Boolean",
"default": false
},
"$readOnly": {
"type": "Scope",
Expand Down Expand Up @@ -135,6 +162,10 @@
"type": "Boolean",
"readAccess": "none"
},
"channel": {
"type": "String",
"readAccess": "none"
},
"info": {
"type": "Object",
"readAccess": "none"
Expand Down
3 changes: 2 additions & 1 deletion services/api/src/routes/auth/apple.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ import yd from '@bedrockio/yada';
import { validateBody } from '../../utils/middleware/validate.js';
import { authenticate } from '../../utils/middleware/authenticate.js';

import { login } from '../../utils/auth/index.js';
import { login, claimUnverifiedUser } from '../../utils/auth/index.js';
import { createAuthToken } from '../../utils/tokens.js';
import { verifyToken, upsertAppleAuthenticator, removeAppleAuthenticator } from '../../utils/auth/apple.js';
import { User, AuditEntry } from '../../models/index.js';
Expand Down Expand Up @@ -36,6 +36,7 @@ router
let result;

if (user) {
claimUnverifiedUser(user);
token = await login(ctx, user, {
message: 'Logged in with Apple',
});
Expand Down
3 changes: 2 additions & 1 deletion services/api/src/routes/auth/google.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ import yd from '@bedrockio/yada';
import { validateBody } from '../../utils/middleware/validate.js';
import { authenticate } from '../../utils/middleware/authenticate.js';

import { login } from '../../utils/auth/index.js';
import { login, claimUnverifiedUser } from '../../utils/auth/index.js';
import { createAuthToken } from '../../utils/tokens.js';
import { verifyToken, upsertGoogleAuthenticator, removeGoogleAuthenticator } from '../../utils/auth/google.js';

Expand Down Expand Up @@ -35,6 +35,7 @@ router
let result;

if (user) {
claimUnverifiedUser(user);
token = await login(ctx, user, {
message: 'Logged in with Google',
});
Expand Down
Loading
Loading