fix: confine app tokens to the projects and scopes they were granted

An app token carried the identity of the install's author — typically an
organization owner — and only the project-scoped path capped it to the
install's granted scopes. Everywhere else it acted with the author's own
privileges, so an install could reach any endpoint its author could, including
the one that repoints its own manifest and thereby widens its own scopes.

App tokens are now denied by default and admitted only where a project context
was actually established, which is the only place the scope cap applies. That
replaces the URL regex the enablement check used to depend on: the regex
matched `/v2/projects/` alone, so the same request against `/api/project/**`
or `/api/repository/**` skipped the check and reached projects the app was
never enabled for.

Managing apps is refused outright. Those endpoints sit under the project an app
is enabled for, so the project binding alone would admit them — an install
whose grant covers project.edit could otherwise enable further apps, disable
the ones already there, or mint a token belonging to another install.

The scope cap also only existed in getCurrentPermittedScopes, so the checks
performed inside handler bodies still fell back to the author's own
permissions; they now apply the same cap. Alongside: a token inherits the
read-only state of the session that minted it, an install whose author has been
disabled no longer authenticates, an expired token is reported as expired
rather than invalid, and a manifest may not claim a baseUrl on Tolgee's own
origin — the iframe sandbox keeps `allow-scripts allow-same-origin`, which
stops isolating anything if the app is served from the origin it is framed by.

Author: JanCizmar

backend/api/src/main/kotlin/io/tolgee/api/v2/controllers/apps/AppSelfRegistrationController.kt

@@ -12,10 +12,12 @@ import io.tolgee.hateoas.organization.apps.AppInstallModel
 import io.tolgee.hateoas.organization.apps.AppInstallModelAssembler
 import io.tolgee.model.Organization
 import io.tolgee.model.UserAccount
+import io.tolgee.security.ratelimit.RateLimited
 import io.tolgee.service.apps.AppInstallService
 import io.tolgee.service.organization.OrganizationRoleService
 import io.tolgee.service.organization.OrganizationService
 import io.tolgee.service.security.UserAccountService
+import io.tolgee.util.constantTimeEquals
 import jakarta.validation.Valid
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty
 import org.springframework.web.bind.annotation.CrossOrigin
@@ -24,7 +26,6 @@ import org.springframework.web.bind.annotation.RequestBody
 import org.springframework.web.bind.annotation.RequestHeader
 import org.springframework.web.bind.annotation.RequestMapping
 import org.springframework.web.bind.annotation.RestController
-import java.security.MessageDigest
 
 /**
  * Lets an app register itself against a running server, authenticating with the server-wide
@@ -49,6 +50,7 @@ class AppSelfRegistrationController(
   private val tolgeeProperties: TolgeeProperties,
 ) {
   @PostMapping("/self-register")
+  @RateLimited(5, isAuthentication = true)
   @Operation(
     summary = "Register an app using the server-wide registration secret",
     description =
@@ -104,13 +106,6 @@ class AppSelfRegistrationController(
     }
   }
 
-  private fun constantTimeEquals(
-    a: String,
-    b: String,
-  ): Boolean {
-    return MessageDigest.isEqual(a.toByteArray(), b.toByteArray())
-  }
-
   companion object {
     const val REGISTRATION_SECRET_HEADER = "X-Tolgee-App-Registration-Secret"
   }

backend/api/src/main/kotlin/io/tolgee/api/v2/controllers/apps/AppTokenEndpointController.kt

@@ -10,7 +10,9 @@ import io.tolgee.exceptions.AuthenticationException
 import io.tolgee.exceptions.BadRequestException
 import io.tolgee.hateoas.apps.AppAccessTokenModel
 import io.tolgee.security.authentication.AppTokenService
+import io.tolgee.security.ratelimit.RateLimited
 import io.tolgee.service.apps.AppInstallService
+import io.tolgee.util.constantTimeEquals
 import jakarta.validation.Valid
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty
 import org.springframework.web.bind.annotation.CrossOrigin
@@ -39,6 +41,7 @@ class AppTokenEndpointController(
   private val tolgeeProperties: TolgeeProperties,
 ) {
   @PostMapping("/token")
+  @RateLimited(5, isAuthentication = true)
   @Operation(
     summary = "Exchange app client credentials for an access token",
     description =
@@ -70,18 +73,6 @@ class AppTokenEndpointController(
     )
   }
 
-  private fun constantTimeEquals(
-    a: String,
-    b: String,
-  ): Boolean {
-    if (a.length != b.length) return false
-    var result = 0
-    for (i in a.indices) {
-      result = result or (a[i].code xor b[i].code)
-    }
-    return result == 0
-  }
-
   companion object {
     private const val GRANT_TYPE_CLIENT_CREDENTIALS = "client_credentials"
   }

backend/api/src/main/kotlin/io/tolgee/api/v2/controllers/project/ProjectAppsController.kt

@@ -11,6 +11,7 @@ import io.tolgee.model.enums.Scope
 import io.tolgee.security.ProjectHolder
 import io.tolgee.security.authentication.AppTokenService
 import io.tolgee.security.authentication.AuthenticationFacade
+import io.tolgee.security.authentication.DenyAppAccess
 import io.tolgee.security.authorization.RequiresProjectPermissions
 import io.tolgee.security.authorization.UseDefaultPermissions
 import io.tolgee.service.apps.AppEnablementService
@@ -30,6 +31,7 @@ import org.springframework.web.bind.annotation.RestController
 @ConditionalOnProperty(name = ["tolgee.apps.enabled"], havingValue = "true")
 @RequestMapping(value = ["/v2/projects/{projectId:[0-9]+}/apps"])
 @Tag(name = "Project Apps")
+@DenyAppAccess
 class ProjectAppsController(
   private val projectHolder: ProjectHolder,
   private val authenticationFacade: AuthenticationFacade,
@@ -124,6 +126,7 @@ class ProjectAppsController(
         installId = installId,
         userId = authenticationFacade.authenticatedUser.id,
         projectId = projectId,
+        isReadOnly = authenticationFacade.isReadOnly,
       )
     return AppTokenModel(token = token)
   }

backend/app/src/main/kotlin/io/tolgee/configuration/WebSecurityConfig.kt

@@ -19,6 +19,7 @@ package io.tolgee.configuration
 import io.tolgee.component.ExceptionHandlerFilter
 import io.tolgee.component.TransferEncodingHeaderDebugFilter
 import io.tolgee.security.authentication.AdminAccessInterceptor
+import io.tolgee.security.authentication.AppAccessInterceptor
 import io.tolgee.security.authentication.AuthenticationFilter
 import io.tolgee.security.authentication.AuthenticationInterceptor
 import io.tolgee.security.authentication.EmailValidationInterceptor
@@ -75,6 +76,8 @@ class WebSecurityConfig(
   @Lazy
   private val projectAuthorizationInterceptor: ProjectAuthorizationInterceptor,
   @Lazy
+  private val appAccessInterceptor: AppAccessInterceptor,
+  @Lazy
   private val featureAuthorizationInterceptor: FeatureAuthorizationInterceptor,
   private val exceptionHandlerFilter: ExceptionHandlerFilter,
 ) : WebMvcConfigurer {
@@ -144,6 +147,9 @@ class WebSecurityConfig(
     registry
       .addInterceptor(projectAuthorizationInterceptor)
       .addPathPatterns(*PROJECT_ENDPOINTS)
+    // Must follow projectAuthorizationInterceptor: it decides based on whether a project context was
+    // established for the request.
+    registry.addInterceptor(appAccessInterceptor)
     registry
       .addInterceptor(adminAccessInterceptor)
       .addPathPatterns(*ADMIN_ENDPOINTS)