Improvement: Add explicit scope allowlist

Author: rashmithachamikara

portal/backend/internal/system/auth/manager.go

@@ -130,8 +130,11 @@ func (m *Manager) RequireAPI(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		required, ok := ScopeForAPIRequest(r.Method, r.URL.Path)
 		if !ok {
-			// Preserve the proxy's canonical 404/405 behavior for unknown routes.
-			next.ServeHTTP(w, r)
+			if isKnownAPIPath(r.URL.Path) {
+				writeError(w, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", "method not allowed")
+				return
+			}
+			writeError(w, http.StatusNotFound, "NOT_FOUND", "route not found")
 			return
 		}
 		m.Require(next, required).ServeHTTP(w, r)

portal/backend/internal/system/auth/scopes.go

@@ -5,7 +5,10 @@
 
 package auth
 
-import "strings"
+import (
+	"net/http"
+	"strings"
+)
 
 // ScopePrefix and the remaining constants define the canonical portal authorization scopes.
 const (
@@ -31,34 +34,73 @@ var AllPortalScopes = []string{
 	ScopePurposesRead, ScopePurposesWrite,
 }
 
-// ScopeForAPIRequest returns the canonical scope for an allowlisted /api request.
+type apiScopePolicy struct {
+	method, pattern, scope string
+}
+
+// apiScopePolicies explicitly allowlists operations exposed through the
+// catch-all API proxy. New upstream operations require a deliberate policy.
+var apiScopePolicies = []apiScopePolicy{
+	{http.MethodGet, "/api/consents", ScopeConsentsReadAny},
+	{http.MethodPost, "/api/consents", ScopeConsentsWriteAny},
+	{http.MethodGet, "/api/consents/attributes", ScopeConsentsReadAny},
+	{http.MethodPost, "/api/consents/validate", ScopeConsentsReadAny},
+	{http.MethodGet, "/api/consents/{consentId}", ScopeConsentsReadAny},
+	{http.MethodPut, "/api/consents/{consentId}", ScopeConsentsWriteAny},
+	{http.MethodGet, "/api/consents/{consentId}/history", ScopeConsentsReadAny},
+	{http.MethodPost, "/api/consents/{consentId}/revoke", ScopeConsentsWriteAny},
+	{http.MethodGet, "/api/consents/{consentId}/authorizations", ScopeConsentsReadAny},
+	{http.MethodPost, "/api/consents/{consentId}/authorizations", ScopeConsentsWriteAny},
+	{http.MethodGet, "/api/consents/{consentId}/authorizations/{authorizationId}", ScopeConsentsReadAny},
+	{http.MethodPut, "/api/consents/{consentId}/authorizations/{authorizationId}", ScopeConsentsWriteAny},
+	{http.MethodGet, "/api/consent-elements", ScopeElementsRead},
+	{http.MethodPost, "/api/consent-elements", ScopeElementsWrite},
+	{http.MethodGet, "/api/consent-elements/{elementId}", ScopeElementsRead},
+	{http.MethodGet, "/api/consent-elements/{elementId}/versions", ScopeElementsRead},
+	{http.MethodPost, "/api/consent-elements/{elementId}/versions", ScopeElementsWrite},
+	{http.MethodGet, "/api/consent-elements/{elementId}/versions/{version}", ScopeElementsRead},
+	{http.MethodDelete, "/api/consent-elements/{elementId}/versions/{version}", ScopeElementsWrite},
+	{http.MethodGet, "/api/consent-purposes", ScopePurposesRead},
+	{http.MethodPost, "/api/consent-purposes", ScopePurposesWrite},
+	{http.MethodGet, "/api/consent-purposes/{purposeId}", ScopePurposesRead},
+	{http.MethodGet, "/api/consent-purposes/{purposeId}/versions", ScopePurposesRead},
+	{http.MethodPost, "/api/consent-purposes/{purposeId}/versions", ScopePurposesWrite},
+	{http.MethodGet, "/api/consent-purposes/{purposeId}/versions/{version}", ScopePurposesRead},
+	{http.MethodDelete, "/api/consent-purposes/{purposeId}/versions/{version}", ScopePurposesWrite},
+}
+
+// ScopeForAPIRequest returns the canonical scope for an explicitly allowlisted
+// API operation.
 func ScopeForAPIRequest(method, path string) (string, bool) {
 	method = strings.ToUpper(method)
-	parts := strings.Split(strings.Trim(strings.TrimPrefix(path, "/api/"), "/"), "/")
-	if len(parts) == 0 || parts[0] == "" {
-		return "", false
-	}
-	write := method == "POST" || method == "PUT" || method == "DELETE"
-	switch parts[0] {
-	case "consents":
-		if len(parts) == 2 && parts[1] == "validate" && method == "POST" {
-			return ScopeConsentsReadAny, true
-		}
-		if write {
-			return ScopeConsentsWriteAny, true
+	for _, policy := range apiScopePolicies {
+		if method == policy.method && matchAPIPath(policy.pattern, path) {
+			return policy.scope, true
 		}
-		return ScopeConsentsReadAny, method == "GET"
-	case "consent-elements":
-		if write {
-			return ScopeElementsWrite, true
+	}
+	return "", false
+}
+
+func isKnownAPIPath(path string) bool {
+	for _, policy := range apiScopePolicies {
+		if matchAPIPath(policy.pattern, path) {
+			return true
 		}
-		return ScopeElementsRead, method == "GET"
-	case "consent-purposes":
-		if write {
-			return ScopePurposesWrite, true
+	}
+	return false
+}
+
+func matchAPIPath(pattern, path string) bool {
+	patternParts := strings.Split(strings.Trim(pattern, "/"), "/")
+	pathParts := strings.Split(strings.Trim(path, "/"), "/")
+	if len(patternParts) != len(pathParts) {
+		return false
+	}
+	for i, patternPart := range patternParts {
+		placeholder := strings.HasPrefix(patternPart, "{") && strings.HasSuffix(patternPart, "}")
+		if (!placeholder && patternPart != pathParts[i]) || pathParts[i] == "" {
+			return false
 		}
-		return ScopePurposesRead, method == "GET"
-	default:
-		return "", false
 	}
+	return true
 }

portal/backend/internal/system/auth/scopes_test.go

@@ -102,14 +102,27 @@ func TestEveryAPIRouteHasCanonicalScopePolicy(t *testing.T) {
 		}
 	}
 	for _, test := range []struct{ method, path string }{
-		{"PATCH", "/api/consents/c1"}, {"GET", "/api/unknown"}, {"GET", "/not-api/consents"},
+		{"PATCH", "/api/consents/c1"},
+		{"GET", "/api/unknown"},
+		{"GET", "/not-api/consents"},
+		{"POST", "/api/consents/c1/export"},
+		{"DELETE", "/api/consent-elements/e1"},
 	} {
 		if scope, ok := ScopeForAPIRequest(test.method, test.path); ok {
 			t.Errorf("unexpected policy for %s %s: %q", test.method, test.path, scope)
 		}
 	}
 }
 
+func TestKnownAPIPathIgnoresMethod(t *testing.T) {
+	if !isKnownAPIPath("/api/consents/c1/revoke") {
+		t.Fatal("documented API path should be known")
+	}
+	if isKnownAPIPath("/api/consents/c1/export") {
+		t.Fatal("undocumented API path should not be known")
+	}
+}
+
 func TestOpenAPIScopesMatchCanonicalRoutePolicies(t *testing.T) {
 	path := filepath.Join("..", "..", "..", "openapi", "portal-backend.yaml")
 	content, err := os.ReadFile(path)