Scoped PATs: clean up team scope entries on member removal (#7778)

Author: cstns

forge/db/controllers/Team.js

@@ -134,6 +134,37 @@ module.exports = {
             }
             await userRole.destroy()
 
+            // Clean up scoped PAT entries that reference this team.
+            // Find which tokens had scopes for this team, remove those
+            // entries, then delete any tokens left with zero team scopes
+            // (they were scoped exclusively to the removed team and would
+            // otherwise silently escalate to team-global access).
+            const affectedScopes = await app.db.models.AccessTokenTeamScope.findAll({
+                where: { UserId: user.id, TeamId: team.id },
+                attributes: ['AccessTokenId']
+            })
+            const affectedTokenIds = affectedScopes.map(s => s.AccessTokenId)
+            if (affectedTokenIds.length > 0) {
+                await app.db.sequelize.transaction(async (t) => {
+                    await app.db.models.AccessTokenTeamScope.destroy({
+                        where: { UserId: user.id, TeamId: team.id },
+                        transaction: t
+                    })
+                    for (const tokenId of affectedTokenIds) {
+                        const remaining = await app.db.models.AccessTokenTeamScope.count({
+                            where: { AccessTokenId: tokenId },
+                            transaction: t
+                        })
+                        if (remaining === 0) {
+                            await app.db.models.AccessToken.destroy({
+                                where: { id: tokenId },
+                                transaction: t
+                            })
+                        }
+                    }
+                })
+            }
+
             await app.db.controllers.StorageSession.removeUserFromTeamSessions(user, team)
 
             return true

forge/routes/api/admin.js

@@ -401,7 +401,7 @@ module.exports = async function (app) {
     })
 
     app.post('/expert-agent-creds', {
-        preHandler: app.needsPermission('platform:expert-agent:creds'),
+        preHandler: [app.blockPAT, app.needsPermission('platform:expert-agent:creds')],
         schema: {
             summary: 'Regenerate expert agent credentials - admin-only',
             tags: ['Platform'],

forge/routes/api/device.js

@@ -875,7 +875,7 @@ module.exports = async function (app) {
      * Start device logging
      */
     app.post('/:deviceId/logs', {
-        preHandler: app.needsPermission('device:read'),
+        preHandler: [app.blockPAT, app.needsPermission('device:read')],
         schema: {
             summary: 'Start device logging',
             tags: ['Devices'],
@@ -909,10 +909,10 @@ module.exports = async function (app) {
     })
 
     /**
-     * Start device resouce stream
+     * Start a device resource stream
      */
     app.post('/:deviceId/resources', {
-        preHandler: app.needsPermission('device:read'),
+        preHandler: [app.blockPAT, app.needsPermission('device:read')],
         schema: {
             summary: 'Start device logging',
             tags: ['Devices'],

forge/routes/api/team.js

@@ -952,7 +952,7 @@ module.exports = async function (app) {
      * @name /api/v1/teams/:teamId/comms-credentials
      */
     app.post('/:teamId/comms-credentials', {
-        preHandler: app.needsPermission('team:read'),
+        preHandler: [app.blockPAT, app.needsPermission('team:read')],
         schema: {
             summary: 'Issue team-channel broker credentials for the current user/session',
             tags: ['Teams'],

forge/routes/api/user.js

@@ -435,7 +435,7 @@ module.exports = async function (app) {
      * Initialize expert chat
      */
     app.post('/expert-creds', {
-        // preHandler: app.needsPermission('xxx'), // all users can start an expert chat, but we might want to add a permission later
+        preHandler: app.blockPAT,
         schema: {
             summary: 'Initialize expert chat',
             tags: ['User'],

frontend/src/api/user.js

@@ -204,14 +204,17 @@ const getPersonalAccessTokens = async () => {
 }
 
 /**
- * Create new User Personal Access Token
+ * Create a new User Personal Access Token
  * See [routes/api/user.js](../../../forge/routes/api/user.js)
  * @param {string} name
  * @param {string} scope
  * @param {number} expiresAt
+ * @param {boolean} readOnly
+ * @param {boolean} adminOptIn
+ * @param {Array<string>} teamIds
  */
-const createPersonalAccessToken = async (name, scope, expiresAt) => {
-    return client.post('/api/v1/user/tokens', { name, scope, expiresAt }).then(res => res.data)
+const createPersonalAccessToken = async (name, scope, expiresAt, { readOnly, adminOptIn, teamIds } = {}) => {
+    return client.post('/api/v1/user/tokens', { name, scope, expiresAt, readOnly, adminOptIn, teamIds }).then(res => res.data)
 }
 
 /**
@@ -224,10 +227,18 @@ const deletePersonalAccessToken = async (id) => {
 }
 
 /**
- * Update User Personal Token
+ * Update User Personal Access Token
+ * See [routes/api/user.js](../../../forge/routes/api/user.js)
+ * @param {string} id The token ID to update
+ * @param {string} scope The token scope
+ * @param {number} expiresAt Expiration timestamp
+ * @param {Object} options Optional configuration
+ * @param {boolean} options.readOnly Whether the token is read-only
+ * @param {boolean} options.adminOptIn Whether admin opt-in is enabled
+ * @param {Array<string>} options.teamIds Array of team IDs the token is scoped to
  */
-const updatePersonalAccessToken = async (id, scope, expiresAt) => {
-    return client.put('/api/v1/user/tokens/' + id, { scope, expiresAt })
+const updatePersonalAccessToken = async (id, scope, expiresAt, { readOnly, adminOptIn, teamIds } = {}) => {
+    return client.put('/api/v1/user/tokens/' + id, { scope, expiresAt, readOnly, adminOptIn, teamIds }).then(res => res.data)
 }
 
 const enableMFA = async () => {

frontend/src/pages/account/Security/Tokens.vue

@@ -9,7 +9,7 @@
         <template #actions>
             <ff-button data-action="new-token" @click="newToken()">
                 <template #icon-left>
-                    <PlusSmallIcon />
+                    <PlusIcon />
                 </template>
                 Add Token
             </ff-button>
@@ -29,7 +29,7 @@
 </template>
 
 <script>
-import { PlusSmallIcon } from '@heroicons/vue/24/outline'
+import { PlusIcon } from '@heroicons/vue/24/outline'
 import { markRaw } from 'vue'
 
 import userApi from '../../../api/user.js'
@@ -40,29 +40,89 @@ import ExpiryCell from '../components/ExpiryCell.vue'
 import TokenCreated from './dialogs/TokenCreated.vue'
 import TokenDialog from './dialogs/TokenDialog.vue'
 
+import { pluralize } from '@/composables/strings/String.js'
+import { useAccountAuthStore } from '@/stores/account-auth.js'
+
 export default {
     name: 'PersonalAccessTokens',
     components: {
-        PlusSmallIcon,
+        PlusIcon,
         SectionTopMenu,
         TokenDialog,
         TokenCreated
     },
     data () {
         return {
             loading: false,
-            tokens: [],
-            columns: [
+            tokens: []
+        }
+    },
+    computed: {
+        isAdmin () {
+            return useAccountAuthStore().isAdminUser
+        },
+        columns () {
+            return [
                 { label: 'Name', key: 'name', sortable: true },
-                // { label: 'Scope', key: 'scope' },
+                {
+                    label: 'Teams',
+                    key: 'teams',
+                    sortable: false,
+                    component: {
+                        is: markRaw({
+                            name: 'TeamsCell',
+                            props: ['teams'],
+                            template: '<span :title="tooltip" style="cursor:help">{{ label }}</span>',
+                            computed: {
+                                label () {
+                                    if (!this.teams || this.teams.length === 0) {
+                                        return 'All Teams'
+                                    }
+                                    return 'Team Scoped'
+                                },
+                                tooltip () {
+                                    if (!this.teams || this.teams.length === 0) {
+                                        return 'This token has access to all teams in your account'
+                                    }
+                                    return `This Token is scoped to the following ${pluralize('team', this.teams.length)}: \n${this.teams.map(t => t.name).join('\n')}`
+                                }
+                            }
+                        })
+                    }
+                },
+                {
+                    label: 'Read Only',
+                    key: 'readOnly',
+                    sortable: false,
+                    component: {
+                        is: markRaw({
+                            name: 'ReadOnlyCell',
+                            props: ['readOnly'],
+                            template: '<span v-if="readOnly" class="ff-badge ff-badge--info">Read Only</span><span v-else></span>'
+                        })
+                    }
+                },
+                {
+                    label: 'Admin Access',
+                    key: 'adminOptIn',
+                    sortable: false,
+                    hidden: !this.isAdmin,
+                    component: {
+                        is: markRaw({
+                            name: 'AdminOptInCell',
+                            props: ['adminOptIn'],
+                            template: '<span v-if="adminOptIn" class="text-green-500">&#x2714;</span><span v-else class="text-red-500">&#x2718;</span>'
+                        })
+                    }
+                },
                 {
                     label: 'Expires',
                     key: 'expiresAt',
                     component: {
                         is: markRaw(ExpiryCell)
                     }
                 }
-            ]
+            ].filter(col => !col.hidden)
         }
     },
     mounted () {