Do not list system-scope entities to unauthenticated callers (/x/api/v1/entities)

Open
  • Is something wrong?
#3,220 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
javascript, openapi, php
Domain
authentication, backend-api-design

Research direction

Start with src/siteRoutes/v1/entities.js in haxcms-nodejs and system/backend/php/lib/siteRoutes/v1/entities.php in haxcms-php, then inspect the shared descriptor builder and each route’s auth checks. Add tests in both backends for unauthenticated, authenticated, JWT-only, and wrong-user-token requests, including the version surfaces from #3174. Update both site OpenAPI specs identically; done means both backends meet the acceptance criteria and the specs match.

Written by the indexing model from the issue text.

Description

Summary

GET /x/api/v1/entities is public by default (the site spec has global security: []) and returns entity descriptors merged across both site and system scopes. Unauthenticated callers can therefore list system-scope entities and their endpoints, and ?scope=system is honored with no auth check. This becomes a bigger fingerprinting surface once plugins contribute entities, since an unauthenticated plugin list would reveal the build.

Split out of https://github.com/haxtheweb/issues/issues/3174, whose version-exposure work landed in https://github.com/haxtheweb/haxcms-nodejs/pull/152 and https://github.com/haxtheweb/haxcms-php/pull/712.

Where it lives today

  • haxcms-nodejs: src/siteRoutes/v1/entities.js (buildEntityDescriptorsFromRegistry(registry, scope) reads req.query.scope with no auth check)
  • haxcms-php: system/backend/php/lib/siteRoutes/v1/entities.php (reads $_GET['scope'] the same way)
  • /system/api/v1/entities shares the same descriptor builder

Proposed

  • Unauthenticated /x/api/v1/entities returns only site-scope descriptors, regardless of ?scope=.
  • Callers with both a valid JWT and X-HAXCMS-User-Token keep the current merged listing and ?scope= filtering.
  • JWT only: existing "user token header is required" behavior. Wrong user token: existing "Invalid" behavior. No new error shapes.
  • Identical behavior in both backends, with the site OpenAPI specs updated and kept identical.

Acceptance criteria

  • Unauthenticated listing contains no system-scope descriptors, with or without ?scope=system (tests in both backends)
  • Authenticated listing unchanged (tests in both backends)
  • JWT-only and wrong-user-token cases tested for this route
  • Also add the JWT-only and wrong-user-token tests that #3174 asked for on the version surfaces, which were not part of the merged PRs
  • Site OpenAPI specs updated in both backends and kept identical
  • One PR per repo, cross-linked, not merged by the author

Generated by Claude Code

Dominant language
JavaScript
Stars
12
Forks
5
Avg merge
4h 27m
Merged PRs (30d)
5

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from haxtheweb/issues

All issues in haxtheweb/issues

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.