Enforce API-only endpoint restrictions on /debug/* routes#49607
Enforce API-only endpoint restrictions on /debug/* routes#49607lukeheath wants to merge 1 commit into
Conversation
A global-admin API-only token scoped to an api_endpoints allowlist could still reach every /debug/* route, because the debug handler's middleware only checked for the global-admin role and never consulted the token's endpoint restrictions like the main API path does. Debug routes are not in the public API catalog, so they can never appear in an allowlist. Deny restricted API-only tokens (api_only with a non-empty api_endpoints list) at the debug middleware, matching the least-privilege scoping APIOnlyEndpointCheck enforces elsewhere.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
WalkthroughDebug authentication now rejects API-only users with a non-empty endpoint allowlist before serving debug routes. Tests cover the forbidden response for restricted tokens and successful responses for regular admin sessions, unrestricted API-only users, and API-only users with an empty endpoint list. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Warning
- Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.
Pull request overview
Closes a least-privilege gap where global-admin API-only tokens restricted via api_endpoints could still access /debug/* routes because the debug handler path did not enforce endpoint allowlisting.
Changes:
- Add a guard in the debug authentication middleware to deny restricted API-only users (
APIOnly && len(APIEndpoints) > 0) from accessing any/debug/*routes. - Add/adjust unit tests to cover the new forbidden path for restricted API-only users and to ensure unrestricted admin/API-only users still succeed.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| server/service/debug_handler.go | Deny restricted API-only users from all /debug/* routes in debug middleware. |
| server/service/debug_handler_test.go | Add coverage for restricted API-only denial and keep success cases for unrestricted admin/API-only users. |
| changes/16879-debug-api-only-restriction | User-visible change note (content excluded from review). |
Files excluded by content exclusion policy (1)
- changes/16879-debug-api-only-restriction
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| if v.User.APIOnly && len(v.User.APIEndpoints) > 0 { | ||
| http.Error(w, "Unauthorized", http.StatusForbidden) | ||
| return |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #49607 +/- ##
==========================================
- Coverage 67.81% 67.81% -0.01%
==========================================
Files 3890 3890
Lines 247635 247638 +3
Branches 12982 12982
==========================================
- Hits 167943 167940 -3
- Misses 64529 64532 +3
- Partials 15163 15166 +3
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Related issue: Resolves fleetdm/confidential#16879
Summary
A global-admin API-only token that was scoped to an
api_endpointsallowlist could still reach every/debug/*route. The debug handler is served separately from the main API (debugMux→MakeDebugHandler) and its middleware only checked for a valid bearer token plus the global-admin role. It never ranAPIOnlyEndpointCheck, so the token's endpoint restrictions were ignored there.This is admin-gated, so it is not a cross-role privilege escalation. It is a least-privilege / defense-in-depth gap: it breaks the guarantee of the
api_endpointsfeature ("this token can do only these things") for tokens that also hold the global-admin role.Debug routes are intentionally not part of the public API catalog, so they can never appear in any token's allowlist. The fix denies restricted API-only tokens (
api_onlywith a non-emptyapi_endpointslist) in the debug middleware, right after the existing global-admin check. Unrestricted API-only admin tokens (emptyapi_endpoints) still pass, matching howAPIOnlyEndpointCheckis a no-op for unrestricted tokens on the main API path.Checklist for submitter
changes/.SELECT *is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.Testing
For unreleased bug fixes in a release candidate, one of:
Summary by CodeRabbit
403 Forbiddenresponse.