From 57f4b6107efc0cdc1933e844946fe3cb74bb61e8 Mon Sep 17 00:00:00 2001 From: Juan Castro Date: Fri, 2 Oct 2026 15:33:58 -0400 Subject: [PATCH] test: pin the mint route against the account's own token MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `/auth/create-access-token` carries only `requireAuth`, so it never showed up in the sweep over `requireUserActor` routes — the refusal lives in `AuthService.createAccessToken`, which turns away any access-token actor outright. That holds today, and a leaked full-access token minting itself a sibling that survives revoking the original is exactly what the token swap is meant to rule out, so it is worth a test rather than a reading. --- src/backend/core/http/middleware/fullAccessToken.http.test.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/backend/core/http/middleware/fullAccessToken.http.test.ts b/src/backend/core/http/middleware/fullAccessToken.http.test.ts index 1da434440..8fac75352 100644 --- a/src/backend/core/http/middleware/fullAccessToken.http.test.ts +++ b/src/backend/core/http/middleware/fullAccessToken.http.test.ts @@ -101,6 +101,8 @@ describe('full-access token route admissions', () => { ['POST', '/auth/get-user-app-token', { origin: 'https://probe.test' }], ['POST', '/auth/grant-user-app', { app_uid: 'app-x', permission: 'p' }], ['POST', '/open_item', { path: '~/' }], + // Only `requireAuth` on the route; the refusal is AuthService's. + ['POST', '/auth/create-access-token', { permissions: ['fs:read'] }], ]; it.each(REFUSED)(