Merge pull request #312 from bknd-io/fix/controller-schema-access

fix: putting schema related endpoints behind schema permission and added tests

app/src/data/api/DataController.ts

@@ -96,6 +96,9 @@ export class DataController extends Controller {
       // read entity schema
       hono.get(
          "/schema.json",
+         permission(SystemPermissions.schemaRead, {
+            context: (_c) => ({ module: "data" }),
+         }),
          permission(DataPermissions.entityRead, {
             context: (c) => ({ entity: c.req.param("entity") }),
          }),
@@ -124,6 +127,9 @@ export class DataController extends Controller {
       // read schema
       hono.get(
          "/schemas/:entity/:context?",
+         permission(SystemPermissions.schemaRead, {
+            context: (_c) => ({ module: "data" }),
+         }),
          permission(DataPermissions.entityRead, {
             context: (c) => ({ entity: c.req.param("entity") }),
          }),
@@ -161,7 +167,7 @@ export class DataController extends Controller {
       hono.get(
          "/types",
          permission(SystemPermissions.schemaRead, {
-            context: (c) => ({ module: "data" }),
+            context: (_c) => ({ module: "data" }),
          }),
          describeRoute({
             summary: "Retrieve data typescript definitions",
@@ -182,6 +188,9 @@ export class DataController extends Controller {
        */
       hono.get(
          "/info/:entity",
+         permission(SystemPermissions.schemaRead, {
+            context: (_c) => ({ module: "data" }),
+         }),
          permission(DataPermissions.entityRead, {
             context: (c) => ({ entity: c.req.param("entity") }),
          }),

app/src/modules/permissions/index.ts

@@ -33,3 +33,5 @@ export const schemaRead = new Permission(
 );
 export const build = new Permission("system.build");
 export const mcp = new Permission("system.mcp");
+export const info = new Permission("system.info");
+export const openapi = new Permission("system.openapi");

app/src/modules/server/SystemController.ts

@@ -1,5 +1,3 @@
-/// <reference types="@cloudflare/workers-types" />
-
 import type { App } from "App";
 import {
    datetimeStringLocal,
@@ -359,7 +357,7 @@ export class SystemController extends Controller {
 
    override getController() {
       const { permission, auth } = this.middlewares;
-      const hono = this.create().use(auth());
+      const hono = this.create().use(auth()).use(permission(SystemPermissions.accessApi, {}));
 
       this.registerConfigController(hono);
 
@@ -434,6 +432,9 @@ export class SystemController extends Controller {
 
       hono.get(
          "/permissions",
+         permission(SystemPermissions.schemaRead, {
+            context: (_c) => ({ module: "auth" }),
+         }),
          describeRoute({
             summary: "Get the permissions",
             tags: ["system"],
@@ -446,6 +447,7 @@ export class SystemController extends Controller {
 
       hono.post(
          "/build",
+         permission(SystemPermissions.build, {}),
          describeRoute({
             summary: "Build the app",
             tags: ["system"],
@@ -476,6 +478,7 @@ export class SystemController extends Controller {
 
       hono.get(
          "/info",
+         permission(SystemPermissions.info, {}),
          mcpTool("system_info"),
          describeRoute({
             summary: "Get the server info",
@@ -509,6 +512,7 @@ export class SystemController extends Controller {
 
       hono.get(
          "/openapi.json",
+         permission(SystemPermissions.openapi, {}),
          openAPISpecs(this.ctx.server, {
             info: {
                title: "bknd API",
@@ -516,7 +520,11 @@ export class SystemController extends Controller {
             },
          }),
       );
-      hono.get("/swagger", swaggerUI({ url: "/api/system/openapi.json" }));
+      hono.get(
+         "/swagger",
+         permission(SystemPermissions.openapi, {}),
+         swaggerUI({ url: "/api/system/openapi.json" }),
+      );
 
       return hono;
    }