From f131b64a6e2130dafe2505deab1fb8ff7d6cdbea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rouzbeh=E2=80=A0?=
 <78313022+rqzbeh@users.noreply.github.com>
Date: Sun, 23 Aug 2026 07:30:14 +0330
Subject: [PATCH] fix(security): add test coverage for Tier 1 local-only route
 guard process-spawning endpoints (#11189)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Validated on the combined batch board (gates + typecheck clean) and this branch: security-route-guard-tiers green. Regression coverage for the Hard Rule #15/#17 contract — Tier 1 process-spawning prefixes (/api/services/, /api/mcp/, /api/cli-tools/runtime/) must stay LOCAL_ONLY before any auth check. Conflict with the tip was only stale provider-count docs. Thank you @rqzbeh!
---
 config/quality/eslint-suppressions.json       | 12 +-----------
 tests/unit/security-route-guard-tiers.test.ts | 10 ++++++++++
 2 files changed, 11 insertions(+), 11 deletions(-)
 create mode 100644 tests/unit/security-route-guard-tiers.test.ts

diff --git a/config/quality/eslint-suppressions.json b/config/quality/eslint-suppressions.json
index 3dae8591dd..79875e3148 100644
--- a/config/quality/eslint-suppressions.json
+++ b/config/quality/eslint-suppressions.json
@@ -853,11 +853,6 @@
       "count": 1
     }
   },
-  "src/app/api/usage/call-logs/route.ts": {
-    "no-restricted-imports": {
-      "count": 1
-    }
-  },
   "src/app/api/usage/quota/route.ts": {
     "no-restricted-imports": {
       "count": 1
@@ -953,11 +948,6 @@
       "count": 1
     }
   },
-  "src/app/api/v1/rerank/route.ts": {
-    "no-restricted-imports": {
-      "count": 1
-    }
-  },
   "src/app/api/v1/vscode/[token]/models/route.ts": {
     "no-restricted-syntax": {
       "count": 1
@@ -3259,4 +3249,4 @@
       "count": 5
     }
   }
-}
+}
\ No newline at end of file
diff --git a/tests/unit/security-route-guard-tiers.test.ts b/tests/unit/security-route-guard-tiers.test.ts
new file mode 100644
index 0000000000..dfc1f3c026
--- /dev/null
+++ b/tests/unit/security-route-guard-tiers.test.ts
@@ -0,0 +1,10 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { isLocalOnlyPath } from "../../src/server/authz/routeGuard.ts";
+
+test("isLocalOnlyPath correctly classifies process-spawning endpoints under Tier 1 LOCAL_ONLY", () => {
+  assert.equal(isLocalOnlyPath("/api/services/dario/start"), true);
+  assert.equal(isLocalOnlyPath("/api/mcp/stream"), true);
+  assert.equal(isLocalOnlyPath("/api/cli-tools/runtime/status"), true);
+  assert.equal(isLocalOnlyPath("/api/v1/chat/completions"), false);
+});