Merge pull request #25 from PackmindHub/claude/verify-api-security-xcKgw

Harden session/ingestion token separation and gate admin routes

Author: cteyton

backend/src/application/auth/login.ts

@@ -2,7 +2,7 @@ import type { IUserRepository } from "@/domain/ports/user-repository";
 import type { IAuditRepository } from "@/domain/ports/audit-repository";
 import type { User } from "@/domain/user";
 import { verifyPassword } from "@/infrastructure/crypto/password";
-import { signToken } from "@/infrastructure/crypto/jwt";
+import { signSessionToken } from "@/infrastructure/crypto/jwt";
 
 interface LoginDeps {
 	users: IUserRepository;
@@ -23,7 +23,7 @@ export async function login(
 	const valid = await verifyPassword(passwordHash, input.password);
 	if (!valid) return { error: "invalid_credentials" };
 
-	const sessionJwt = await signToken(
+	const sessionJwt = await signSessionToken(
 		{ sub: user.id, email: user.email, role: user.role },
 		"1d",
 	);

backend/src/http/audit.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import type { AppVariables } from "@/types";
 import type { AppDeps } from "@/bootstrap/compose";
 import { sessionAuth } from "@/middleware/session-auth";
+import { requireAdmin } from "@/middleware/require-admin";
 import { listAuditEvents } from "@/application/audit/list-audit-events";
 import { exportAuditEventsCsv } from "@/application/audit/export-audit-events";
 import { ALL_AUDIT_ACTIONS, type AuditAction, type AuditFilters } from "@/domain/audit";
@@ -54,6 +55,7 @@ function readQueryRecord(c: { req: { queries: () => Record<string, string[] | un
 export function createAuditRoute(deps: Pick<AppDeps, "audit">) {
 	const route = new Hono<{ Variables: AppVariables }>();
 	route.use("*", sessionAuth);
+	route.use("*", requireAdmin);
 
 	route.get("/", async (c) => {
 		const queries = readQueryRecord(c);

backend/src/http/integrations.ts

@@ -5,6 +5,7 @@ import type { AppVariables } from "@/types";
 import type { AppDeps } from "@/bootstrap/compose";
 import { DEFAULT_LOKI_QUERY } from "@/domain/event";
 import { sessionAuth } from "@/middleware/session-auth";
+import { requireAdmin } from "@/middleware/require-admin";
 import { listIntegrations } from "@/application/integrations/list-integrations";
 import { createIntegration } from "@/application/integrations/create-integration";
 import { updateIntegration } from "@/application/integrations/update-integration";
@@ -81,6 +82,7 @@ export function createIntegrationsRoute(
 
 	const route = new Hono<{ Variables: AppVariables }>();
 	route.use("*", sessionAuth);
+	route.use("*", requireAdmin);
 
 	route.get("/", async (c) => {
 		return c.json(await listIntegrations(deps));

backend/src/http/marketplace-sources.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import type { AppVariables } from "@/types";
 import type { AppDeps } from "@/bootstrap/compose";
 import { sessionAuth } from "@/middleware/session-auth";
+import { requireAdmin } from "@/middleware/require-admin";
 import { listMarketplaceSources } from "@/application/marketplace-sources/list-marketplace-sources";
 import { createMarketplaceSource } from "@/application/marketplace-sources/create-marketplace-source";
 import { updateMarketplaceSource } from "@/application/marketplace-sources/update-marketplace-source";
@@ -66,6 +67,7 @@ export function createMarketplaceSourcesRoute(
 
 	const route = new Hono<{ Variables: AppVariables }>();
 	route.use("*", sessionAuth);
+	route.use("*", requireAdmin);
 
 	route.get("/", async (c) => {
 		return c.json(await listMarketplaceSources(deps));

backend/src/http/marketplaces.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import type { AppVariables } from "@/types";
 import type { AppDeps } from "@/bootstrap/compose";
 import { sessionAuth } from "@/middleware/session-auth";
+import { requireAdmin } from "@/middleware/require-admin";
 import { deleteMarketplace } from "@/application/marketplaces/delete-marketplace";
 import {
 	DELETE_MARKETPLACES_MAX_BATCH,
@@ -53,7 +54,7 @@ export function createMarketplacesRoute(
 		return c.json({ marketplaces: await listMarketplaces(deps, { includeIgnored }) });
 	});
 
-	route.post("/bulk-delete", async (c) => {
+	route.post("/bulk-delete", requireAdmin, async (c) => {
 		const body = bulkDeleteSchema.parse(await c.req.json());
 		const result = await deleteMarketplaces(deps, {
 			names: body.names,
@@ -72,7 +73,7 @@ export function createMarketplacesRoute(
 		return c.json(result);
 	});
 
-	route.patch("/bulk-status", async (c) => {
+	route.patch("/bulk-status", requireAdmin, async (c) => {
 		const body = bulkStatusSchema.parse(await c.req.json());
 		const result = await updateMarketplacesStatus(deps, {
 			names: body.names,
@@ -93,7 +94,7 @@ export function createMarketplacesRoute(
 		return c.json(detail);
 	});
 
-	route.patch("/:name", async (c) => {
+	route.patch("/:name", requireAdmin, async (c) => {
 		const name = decodeURIComponent(c.req.param("name"));
 		const body = updateSchema.parse(await c.req.json());
 		const result = await updateMarketplace(
@@ -104,7 +105,7 @@ export function createMarketplacesRoute(
 		return c.json(result);
 	});
 
-	route.delete("/:name", async (c) => {
+	route.delete("/:name", requireAdmin, async (c) => {
 		const name = decodeURIComponent(c.req.param("name"));
 		const mode = deleteModeSchema.parse(c.req.query("mode"));
 		const withSources = c.req.query("withSources") === "true";

backend/src/http/plugins.ts

@@ -5,6 +5,7 @@ import { listPlugins } from "@/application/plugins/list-plugins";
 import { updatePlugin } from "@/application/plugins/update-plugin";
 import type { AppDeps } from "@/bootstrap/compose";
 import { sessionAuth } from "@/middleware/session-auth";
+import { requireAdmin } from "@/middleware/require-admin";
 import type { AppVariables } from "@/types";
 
 const updateSchema = z.object({
@@ -35,7 +36,7 @@ export function createPluginsRoute(
 		return c.json(data);
 	});
 
-	route.patch("/:pluginName", async (c) => {
+	route.patch("/:pluginName", requireAdmin, async (c) => {
 		const pluginName = decodeURIComponent(c.req.param("pluginName"));
 		const body = updateSchema.parse(await c.req.json());
 		const result = await updatePlugin(

backend/src/http/skills/delete.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import type { AppDeps } from "@/bootstrap/compose";
 import { deleteSkills, DELETE_SKILLS_MAX_BATCH } from "@/application/skills/delete-skills";
 import { sessionAuth } from "@/middleware/session-auth";
+import { requireAdmin } from "@/middleware/require-admin";
 import type { AppVariables } from "@/types";
 
 const deleteSchema = z.object({
@@ -20,6 +21,7 @@ const deleteSchema = z.object({
 export function createDeleteRoute(deps: Pick<AppDeps, "skills" | "events" | "audit">) {
 	const route = new Hono<{ Variables: AppVariables }>();
 	route.use("*", sessionAuth);
+	route.use("*", requireAdmin);
 
 	route.post("/delete", async (c) => {
 		const { skills } = deleteSchema.parse(await c.req.json());

backend/src/http/skills/update-status-bulk.ts

@@ -6,6 +6,7 @@ import {
 } from "@/application/skills/update-skills-status";
 import type { AppDeps } from "@/bootstrap/compose";
 import { sessionAuth } from "@/middleware/session-auth";
+import { requireAdmin } from "@/middleware/require-admin";
 import type { AppVariables } from "@/types";
 
 const bulkSchema = z.object({
@@ -24,6 +25,7 @@ const bulkSchema = z.object({
 export function createUpdateStatusBulkRoute(deps: Pick<AppDeps, "skills" | "audit">) {
 	const route = new Hono<{ Variables: AppVariables }>();
 	route.use("*", sessionAuth);
+	route.use("*", requireAdmin);
 
 	route.patch("/status/bulk", async (c) => {
 		const body = bulkSchema.parse(await c.req.json());

backend/src/http/skills/update-status.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { updateSkillStatus } from "@/application/skills/update-skill-status";
 import type { AppDeps } from "@/bootstrap/compose";
 import { sessionAuth } from "@/middleware/session-auth";
+import { requireAdmin } from "@/middleware/require-admin";
 import type { AppVariables } from "@/types";
 
 const updateSchema = z.object({
@@ -14,6 +15,7 @@ const updateSchema = z.object({
 export function createUpdateStatusRoute(deps: Pick<AppDeps, "skills" | "audit">) {
 	const route = new Hono<{ Variables: AppVariables }>();
 	route.use("*", sessionAuth);
+	route.use("*", requireAdmin);
 
 	route.patch("/status", async (c) => {
 		const body = updateSchema.parse(await c.req.json());

backend/src/http/telemetry.test.ts

@@ -3,7 +3,7 @@ import { Hono } from "hono";
 import { createTelemetryRoute } from "./telemetry";
 import type { Token } from "@/domain/token";
 import type { ITokenRepository } from "@/domain/ports/token-repository";
-import { createIngestionToken } from "@/infrastructure/crypto/jwt";
+import { createIngestionToken, signSessionToken } from "@/infrastructure/crypto/jwt";
 
 function makeDeps() {
 	const tokens: ITokenRepository = {
@@ -58,6 +58,24 @@ describe("POST /api/v0/telemetry/v1/logs", () => {
 		expect(res.status).toBe(401);
 	});
 
+	it("returns 401 when a session JWT is presented as the Bearer token", async () => {
+		const deps = makeDeps();
+		const app = makeApp(deps);
+		const sessionJwt = await signSessionToken(
+			{ sub: "user-1", email: "alice@example.com", role: "admin" },
+			"1h",
+		);
+		const res = await app.request("/api/v0/telemetry/v1/logs", {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				Authorization: `Bearer ${sessionJwt}`,
+			},
+			body: JSON.stringify({ resourceLogs: [] }),
+		});
+		expect(res.status).toBe(401);
+	});
+
 	it("returns 400 with partialSuccess on invalid JSON body", async () => {
 		const deps = makeDeps();
 		const app = makeApp(deps);