Ruben Fiszel 7edf3f0212 fix(auth): filter script/flow listings by token scope (GHSA-2ppx-66jv-wpw5) (#9426) ...

A token scoped to a single script or flow path (e.g.
`scripts:read:f/allowed/*`) could call `GET .../scripts/list_search` (or
`/list`) and receive `path` + full `content` for every script the
underlying user could see — likewise `flows/list_search` leaked the full
flow `value`. Route-level scope checks only validate `domain:action`, and
the listing handlers did no per-row scope filtering, leaking out-of-scope
source/definitions to narrowly-scoped tokens.

Apply `build_scope_path_predicate` (added in #9302 for resources/variables)
to `list_search_scripts`, `list_scripts`, `list_search_flows`, and
`list_flows`, mirroring the resources/variables fix exactly. Unscoped
tokens and tokens whose only scopes are `if_jobs:filter_tags:*` are
unaffected.

Adds integration regression tests (scripts + flows) covering: path-scoped
token sees only in-scope paths, broad `*:read` token still sees all
RLS-visible items, tag-filter-only and unscoped tokens unchanged.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-03 08:34:43 +00:00

..

src

fix(auth): filter script/flow listings by token scope (GHSA-2ppx-66jv-wpw5) (#9426)

2026-06-03 08:34:43 +00:00

Cargo.toml

feat: cascade trigger script_path on runnable rename + fix trigger permissioned_as (#8823)

2026-04-14 20:42:13 +00:00