raystack / frontier / 26081496277

42%

main: 45%

Pull #1622

github

fix(authz): require permission checks on GetPolicy, ListOrganizations, ListUsers

These three endpoints previously allowed any authenticated user to read
sensitive data without resource-level authz, leaking policy details and
the platform-wide org/user inventory.

- GetPolicy: fetch the policy, then check policymanage (org/project),
  group admin, or delete on the underlying resource, mirroring
  DeletePolicy.
- ListOrganizations: keep the platform-pref gate, allow self-introspection
  when user_id matches the caller, otherwise require platform superuser.
- ListUsers: keep the platform-pref gate, require get on the org when
  org_id is set, get on the group when group_id is set, otherwise
  require platform superuser.

Adjust three TestUserAPI subtests that called ListUsers as a non-member
regular user to use the existing superuser context, since they verify
filter/keyword behaviour rather than authz.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

0 of 34 new or added lines in 1 file covered. (0.0%)

15969 of 37746 relevant lines covered (42.31%)

11.88 hits per line