fix(credentials): conceal inaccessible credential reads - #6730
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
PR SummaryLow Risk Overview Member-level authorization now raises a dedicated Regression tests cover the authorized use case (deny without membership) and the route handler response shape. Reviewed by Cursor Bugbot for commit 4a72dcb. Bugbot is set up for automated code reviews on this repo. Configure here. |
Greptile SummaryThis PR restores a concealed forbidden response when workspace writers attempt to read credentials they cannot access.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| apps/sim/lib/credentials/application/authorized-credential-use-case.ts | Introduces a classified error for member-level credential-access denials without changing the authorization decision. |
| apps/sim/lib/credentials/api/route-policies.ts | Adds a detail-route policy that conceals the credential-access denial behind a generic forbidden response. |
| apps/sim/app/api/credentials/[id]/route.ts | Applies the specialized error policy to the credential-detail GET endpoint. |
| apps/sim/lib/credentials/application/authorized-credential-use-case.test.ts | Verifies that writers lacking credential membership are denied before the protected operation executes. |
| apps/sim/app/api/credentials/[id]/route.test.ts | Verifies that the credential-detail route returns a generic 403 response for the new denial type. |
Sequence Diagram
sequenceDiagram
participant Writer as Workspace writer
participant Route as GET /api/credentials/[id]
participant UseCase as Credential read use case
participant Policy as Detail error policy
Writer->>Route: Request inaccessible credential
Route->>UseCase: Execute credential read
UseCase-->>Route: CredentialAccessRequiredError
Route->>Policy: Project application error
Policy-->>Writer: "403 {"error":"Forbidden"}"
Reviews (2): Last reviewed commit: "fix(credentials): conceal inaccessible c..." | Re-trigger Greptile
de27b43 to
4a72dcb
Compare
|
@cursor review |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 4a72dcb. Configure here.
Summary
Type of Change
Testing
Passed 501 credential tests, Sim/Auth type-check, full lint, block-registry audit, and all 26 repository audits.
Checklist