firezone / firezone / 41504646300

80%

Build Type

push

github

Committed by web-flow

Commit Message

fix(portal): block admin management via API and MCP (#16179)

A token with only the `actors:write` scope could create an admin,
promote a user to admin, or change an admin's email and email sign-in
setting. The token holder could then sign in to the portal as that admin
and get around every other scope.

Admins can now only be created, changed, or deleted in the portal. The
REST API and MCP tools refuse these requests, and the OpenAPI spec no
longer lists `account_admin_user` as a type you can set. Audit logs from
the last 121 days show no account creating or changing admins through
the API or MCP, so this shouldn't affect existing integrations.

Coverage Stats

1373 of 2287 branches covered (60.03%)

Branch coverage included in aggregate %.

8 of 8 new or added lines in 1 file covered. (100.0%)

7 existing lines in 3 files now uncovered.

94548 of 117484 relevant lines covered (80.48%)

368650.48 hits per line