[PR] A malformed permission grants nothing, not the area it starts with [skywalking-horizon-ui]

["wu-sheng (via GitHub)" <gi...@apache.org>]

wu-sheng opened a new pull request, #147:
URL: https://github.com/apache/skywalking-horizon-ui/pull/147

   `matchOne` parsed grants with `split(':', 3)`, which **truncates** rather than failing. Two consequences, both widening access on a typo:
   
   - **`rule:*:typo` granted all of `rule:*`.** The `area:*` branch never looked at the third segment, so the string was read as the area wildcard — handing over `rule:read`, `rule:write`, `rule:write:structural` and `rule:delete`.
   - **`rule:write:structural:extra` matched `rule:write:structural`.** The fourth segment was silently dropped.
   
   A permission outside the documented grammar now matches nothing. Because `isGrantRecognised` delegates to this matcher, such a grant is also named in the startup warning instead of sitting in a config looking effective.
   
   ## The same bug lived in three places
   
   The matcher has three copies — the BFF, the auth store, and the Roles board — and all three were wrong in the same way, so nothing contradicted anything. Each is fixed, and they are now pinned to a shared table of grant → required → expected cases asserted on both sides (`apps/bff/src/rbac/verbs.test.ts` and `apps/ui/src/state/auth.test.ts`), covering the malformed forms, the documented grammar, and the wildcard-exempt `audit:read`.
   
   ## Validation
   
   Booted against a live OAP with `viewer: ["rule:*:typo", "rule:write:structural:extra"]`:
   
   - Startup warning names both grants.
   - `GET /api/rule`, `GET /api/rule/status` and `POST /api/rule/delete` all return **403**. Before this change the first two were allowed and the delete was one `rule:delete` away.
   
   `pnpm type-check`, `pnpm lint` and 2709 unit tests pass; license headers clean.
   
   ## Docs
   
   Both grammar tables now say that nothing outside the four forms is a grant, and that the `*` in `area:*` is the whole second segment — `rule:*:anything` is malformed, not a narrower wildcard. Changelog entry under Fixes.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] A malformed permission grants nothing, not the area it starts with [skywalking-horizon-ui]

["wu-sheng (via GitHub)" <gi...@apache.org>]

wu-sheng merged PR #147:
URL: https://github.com/apache/skywalking-horizon-ui/pull/147


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org