From 4ea2a96e1395b84bee150633164ef97d92b64cc5 Mon Sep 17 00:00:00 2001 From: HomerOff Date: Sun, 10 May 2026 13:33:20 -0300 Subject: [PATCH] fix(authz): classify /dashboard/onboarding as PUBLIC to unblock setup wizard (#2127) - Add exact-match guard for /dashboard/onboarding before the broad /dashboard prefix - Add setup_wizard and client_api_mcp to ClassificationReason union type - Update test to verify PUBLIC classification Co-authored-by: HomerOff --- src/server/authz/classify.ts | 8 ++++++++ src/server/authz/types.ts | 2 ++ tests/unit/authz/classify.test.ts | 2 +- 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/src/server/authz/classify.ts b/src/server/authz/classify.ts index 6093714baa..60128281c2 100644 --- a/src/server/authz/classify.ts +++ b/src/server/authz/classify.ts @@ -53,6 +53,14 @@ export function classifyRoute(rawPath: string, method: string = "GET"): RouteCla }; } + if (normalizedPath === "/dashboard/onboarding") { + return { + routeClass: "PUBLIC", + reason: "setup_wizard", + normalizedPath, + }; + } + if (normalizedPath.startsWith("/dashboard")) { return { routeClass: "MANAGEMENT", diff --git a/src/server/authz/types.ts b/src/server/authz/types.ts index a8fd786408..443001dbca 100644 --- a/src/server/authz/types.ts +++ b/src/server/authz/types.ts @@ -28,7 +28,9 @@ export type ClassificationReason = | "public_prefix" | "public_readonly_prefix" | "dashboard_prefix" + | "setup_wizard" | "client_api_v1" + | "client_api_mcp" | "client_api_alias" | "client_api_codex_alias" | "client_api_double_prefix" diff --git a/tests/unit/authz/classify.test.ts b/tests/unit/authz/classify.test.ts index 7f6021992e..5870d8ed30 100644 --- a/tests/unit/authz/classify.test.ts +++ b/tests/unit/authz/classify.test.ts @@ -16,7 +16,7 @@ const cases: Case[] = [ { name: "root /", path: "/", expectedClass: "MANAGEMENT", expectedNormalized: "/" }, { name: "dashboard root", path: "/dashboard", expectedClass: "MANAGEMENT" }, { name: "dashboard nested", path: "/dashboard/settings", expectedClass: "MANAGEMENT" }, - { name: "dashboard onboarding", path: "/dashboard/onboarding", expectedClass: "MANAGEMENT" }, + { name: "dashboard onboarding", path: "/dashboard/onboarding", expectedClass: "PUBLIC" }, { name: "/api/v1 base",