fix(api): gate /alerts/ingest on alerts:ingest API key scope - #4208
Merged
dipexplorer merged 1 commit intoAug 8, 2026
Merged
Conversation
API keys carry scopes but no route ever consulted them, so any valid key (including narrowly-scoped read-only keys) could invoke POST /alerts/ingest and reclassify medicines as recalled while mass-broadcasting fake recall alerts to patients. Add requireApiKeyScope(scope) middleware and require alerts:ingest on the ingest route. Keys lacking the scope now receive 403 before acting.
github-actions
Bot
added
gssoc:approved
|
dipexplorer
added
level:critical
github-project-automation
Bot
moved this from 📥 Backlog
to 🎉 Merged
in SahiDawa Workflow
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🛑 STOP: Assignment & File Scope Check
Warning
PRs with unrelated files will not be reviewed and may be closed.
📋 PR Summary & Link
scopesare never enforced , any key holder can trigger the global alert-ingest write path #4199The POST /api/v1/alerts/ingest route was protected only by requireApiKey, but the scopes the middleware loaded into req.apiKey.scopes were never consulted. Any valid key — including narrowly-scoped read-only keys — had the same privilege as the intended moderation credential, enabling attackers to reclassify medicines as recalled and mass-broadcast fake recall alerts.
Changes:
apps/api/src/middleware/apiKeyAuth.ts — added requireApiKeyScope(scope) middleware that returns 403 when req.apiKey.scopes lacks the required scope.
apps/api/src/routes/alerts.ts:194-199 — applied requireApiKeyScope("alerts:ingest") to the /ingest route.
apps/api/tests/alertsPagination.test.ts — added a test asserting a valid key lacking the scope gets 403 (20/20 tests pass).
🏷️ PR Type
type: bugtype: featuretype: docstype: testingtype: securitytype: performancetype: designtype: refactortype: devopstype: accessibility✅ Checklist
Closes #4199)mainand resolved any conflicts