From 422271d10349e557d4c2a4b2d52b2eb68f1e5c92 Mon Sep 17 00:00:00 2001
From: rcourtman <courtmanr@gmail.com>
Date: Wed, 4 Feb 2026 18:11:12 +0000
Subject: [PATCH] Require proxy admin for permissioned endpoints

---
 internal/api/auth.go                     | 26 +++++++++++++++++++++
 internal/api/security_regression_test.go | 29 ++++++++++++++++++++++++
 2 files changed, 55 insertions(+)

diff --git a/internal/api/auth.go b/internal/api/auth.go
index 1884c1c7f..07f45e94b 100644
--- a/internal/api/auth.go
+++ b/internal/api/auth.go
@@ -691,6 +691,32 @@ func RequirePermission(cfg *config.Config, authorizer auth.Authorizer, action, r
 			return
 		}
 
+		// Check if using proxy auth and if so, verify admin status
+		if cfg.ProxyAuthSecret != "" {
+			if valid, username, isAdmin := CheckProxyAuth(cfg, r); valid {
+				if !isAdmin {
+					// User is authenticated but not an admin
+					log.Warn().
+						Str("ip", r.RemoteAddr).
+						Str("path", r.URL.Path).
+						Str("action", action).
+						Str("resource", resource).
+						Str("username", username).
+						Msg("Non-admin user attempted to access permissioned endpoint")
+
+					// Return forbidden error
+					if strings.HasPrefix(r.URL.Path, "/api/") || strings.Contains(r.Header.Get("Accept"), "application/json") {
+						w.Header().Set("Content-Type", "application/json")
+						w.WriteHeader(http.StatusForbidden)
+						w.Write([]byte(`{"error":"Admin privileges required"}`))
+					} else {
+						http.Error(w, "Admin privileges required", http.StatusForbidden)
+					}
+					return
+				}
+			}
+		}
+
 		// Extract user from header (set by CheckAuth) and inject into context
 		username := w.Header().Get("X-Authenticated-User")
 		ctx := r.Context()
diff --git a/internal/api/security_regression_test.go b/internal/api/security_regression_test.go
index c85f2cf87..8ad3764b1 100644
--- a/internal/api/security_regression_test.go
+++ b/internal/api/security_regression_test.go
@@ -2063,6 +2063,8 @@ func TestProxyAuthNonAdminDeniedAdminEndpoints(t *testing.T) {
 		{method: http.MethodPost, path: "/api/system/settings/update", body: `{}`},
 		{method: http.MethodPost, path: "/api/security/reset-lockout", body: `{}`},
 		{method: http.MethodPost, path: "/api/security/apply-restart", body: `{}`},
+		{method: http.MethodGet, path: "/api/security/tokens", body: ``},
+		{method: http.MethodDelete, path: "/api/security/tokens/token-1", body: ``},
 		{method: http.MethodPost, path: "/api/security/regenerate-token", body: `{}`},
 		{method: http.MethodPost, path: "/api/security/validate-token", body: `{"token":"abc"}`},
 		{method: http.MethodPost, path: "/api/security/oidc", body: `{}`},
@@ -2813,6 +2815,33 @@ func TestPermissionProtectedEndpointsDenyWhenAuthorizerBlocks(t *testing.T) {
 	}
 }
 
+func TestPermissionEndpointsRejectProxyNonAdmin(t *testing.T) {
+	prevAuthorizer := auth.GetAuthorizer()
+	auth.SetAuthorizer(&auth.DefaultAuthorizer{})
+	defer auth.SetAuthorizer(prevAuthorizer)
+
+	cfg := newTestConfigWithTokens(t)
+	cfg.ProxyAuthSecret = "proxy-secret"
+	cfg.ProxyAuthUserHeader = "X-Remote-User"
+	cfg.ProxyAuthRoleHeader = "X-Remote-Roles"
+	cfg.ProxyAuthAdminRole = "admin"
+
+	router := NewRouter(cfg, nil, nil, nil, nil, "1.0.0")
+
+	req := httptest.NewRequest(http.MethodGet, "/api/security/tokens", nil)
+	req.Header.Set("X-Proxy-Secret", cfg.ProxyAuthSecret)
+	req.Header.Set("X-Remote-User", "viewer-user")
+	req.Header.Set("X-Remote-Roles", "viewer")
+	rec := httptest.NewRecorder()
+	router.Handler().ServeHTTP(rec, req)
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("expected 403 for non-admin proxy on permissioned endpoint, got %d", rec.Code)
+	}
+	if !strings.Contains(rec.Body.String(), "Admin privileges required") {
+		t.Fatalf("expected admin privilege error, got %q", rec.Body.String())
+	}
+}
+
 func TestApplyRestartRequiresAuthInAPIMode(t *testing.T) {
 	record := newTokenRecord(t, "apply-restart-token-123.12345678", []string{config.ScopeSettingsWrite}, nil)
 	cfg := newTestConfigWithTokens(t, record)