Files
OmniRoute/tests/unit
Xiangzhe 0c52533e01 fix(security): require management scope for OAuth import/auto-import routes
The OAuth import and auto-import routes create or read provider credentials
(connection injection, Cursor token disclosure), but guarded only with
isAuthenticated() — which, because /api/oauth/ is PUBLIC-classified, accepts any
valid client API key. All ten routes now go through requireManagementAuth, so a
non-manage key gets 403 (401 with no credential) while a dashboard session or
manage-scope key still works. Default requireLogin=true is unaffected for
legitimate operators; keyless requireLogin=false stays open by design.

Reported by @EQSTLab via GHSA-mg76-rhpx-gvw3 and @koyokr via GHSA-gxv4-955v-v6cm.
2026-08-21 14:24:39 -03:00
..