gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-12 19:57:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(api-tokens): harden scope enforcement and block sensitive endpoints (#228)

Browse Source 
* fix(api-tokens): harden scope enforcement and add expiration support

- Fix deploy-only allowlist to match actual routes (deploy, down, restart,
  stop, start, update) instead of non-existent /up, /pull, /compose/* paths
- Block API tokens from auth-sensitive routes (password change, node token
  generation) that bypass scope enforcement middleware
- Add WebSocket scope enforcement: read-only/deploy-only tokens can only
  access logs and notifications, not host console or container exec
- Prevent API token self-replication: tokens cannot create, list, or revoke
  other tokens regardless of scope
- Map deploy-only tokens to admin role so they pass requireAdmin on deploy
  routes (scope middleware still restricts which endpoints they can reach)
- Add optional token expiration (30, 60, 90, 365 days or no expiry)
- Add token name length validation (max 100 characters)
- Surface fetchTokens errors in frontend instead of swallowing silently
- Fix docs: correct deploy-only scope description and GitHub Actions example

* fix(api-tokens): block all sensitive management endpoints from API tokens

User management, SSO configuration, node management, license management,
and console access are now human-session-only. Add comprehensive unit
tests for scope enforcement, blocked endpoints, expiration, and revocation.

* fix(api-tokens): fix TS18048 possibly-undefined in test
This commit is contained in:
Anso
2026-03-28 22:14:22 -04:00
committed by GitHub
parent 26c74f2aad
commit 5b607de227
4 changed files with 268 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/features/api-tokens.mdx
+18 -2
View File
@@ -17,15 +17,31 @@ Every token is created with one of three permission levels:
|-------|----------------|
| **Read Only** | `GET` requests only — view stacks, containers, metrics, and settings |
| **Deploy Only** | Everything in Read Only, plus stack operations: deploy, down, restart, stop, start, update |
| **Full Admin** | Unrestricted access — equivalent to an admin user session |
| **Full Admin** | Full stack and container management — all read and write operations on stacks, containers, images, and system metrics |
Choose the narrowest scope that fits your use case. A CI pipeline that only deploys stacks should use **Deploy Only**, not Full Admin.
### Universal restrictions
Regardless of scope, **all** API tokens are blocked from:
| Category | Description |
|----------|-------------|
| **Password management** | Changing user passwords |
| **User management** | Creating, updating, deleting, or listing user accounts |
| **SSO configuration** | Viewing, creating, updating, deleting, or testing SSO providers |
| **Node management** | Adding, updating, or deleting remote nodes |
| **License management** | Activating or deactivating license keys |
| **Token management** | Creating, listing, or revoking API tokens |
| **Console access** | Generating console session tokens for interactive terminals |
These restrictions ensure that API tokens cannot escalate privileges or modify the identity and infrastructure configuration of your Sencho instance. These operations require a human user session (browser login).
## Creating a token
1. Open **Settings Hub** and navigate to the **API Tokens** tab (visible to Team Pro admins only).
2. Click **Create Token**.
3. Enter a descriptive name (e.g., "GitHub Actions deploy") and select a permission scope.
3. Enter a descriptive name (e.g., "GitHub Actions deploy"), select a permission scope, and optionally choose an expiration period (30, 60, 90 days, or 1 year). Tokens without an expiration must be revoked manually.
4. Click **Create**. The raw token is displayed **once** — copy it immediately.
<Frame>