mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 04:50:59 +00:00
Antiheld86
56d6fb180a
The mint used requireAuth() with no scope, which refuses a narrow token but still admits a cookie-equivalent one. The reach is not the problem — a wildcard token can already do everything this endpoint does. The lifetimes are: a native access token lives a day, and what it mints here lives a year. So a credential that leaked for an afternoon could leave behind one that outlives revoking it, and the revocation would look like it had worked. requireCookieAuth() closes that. It is the helper the passkey registration and trusted-device routes already use for the same reason, and the sharing guard recognises it as cookie-only. The prose said more than the code did, in three places: the route header and the OpenAPI description both claimed the endpoint "cannot mint another token", which held only for narrow tokens, and the 403 arm described a scope refusal that a Bearer never reaches. All three now say what is true — no Bearer credential reaches this endpoint at any scope, and a Bearer is refused 401 before the operator switch is read. Tests follow the status change: the integration case asserting a scoped token cannot mint now expects 401 rather than 403, since the refusal is authentication and not scope, and a companion case pins the wildcard — the credential class this change is actually about — and asserts no token row is created.