[fix] Resolve IDOR vulnerability: add workspace/project membership check in auth middleware and fix cache-before-auth

[junaway]

Summary

• Add project membership validation in the authentication middleware (verify_bearer_token). When a user supplies an explicit project_id query parameter, the middleware now verifies the user is a member of that project before proceeding. Previously it only checked the project existed.
• Fix cache-before-auth ordering in vault/router.py (list_secrets) and app_router.py (list_app_variants) — the RBAC permission check now runs before the cache lookup, preventing cached responses from bypassing authorization.

Test plan

• Authenticated user requesting their own project works as before
• Authenticated user requesting another user's project_id gets 401
• Requests without explicit project_id (default project) still work
• API key auth still works (project derived from key, not query param)
• list_secrets and list_app_variants enforce permissions on cache hits

---

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agenta-documentation	Ready	Preview, Comment	Feb 9, 2026 3:37pm

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 5 additional findings.

[Copilot]

Pull request overview

This PR hardens authorization in the API by preventing cross-project access (IDOR) through explicit project_id query parameters and by ensuring RBAC checks run before cache lookups, so cached responses can’t bypass permissions.

Changes:

• Add an EE-only project membership check in verify_bearer_token when project_id is explicitly provided.
• Reorder authorization vs caching in list_secrets and list_app_variants so permission checks occur before cache reads.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
api/oss/src/services/auth_service.py	Adds EE project membership validation for explicit project_id in bearer-token auth.
api/oss/src/routers/app_router.py	Moves RBAC enforcement ahead of cache reads in list_app_variants.
api/oss/src/apis/fastapi/vault/router.py	Moves RBAC enforcement ahead of cache reads in list_secrets.

Comments suppressed due to low confidence (1)

api/oss/src/routers/app_router.py:103

• Test coverage: add a test that ensures RBAC is enforced on cache hits for list_app_variants (i.e., a cached response must not be returned when check_action_access denies). This change fixes an auth bypass and should be guarded by a regression test.

    if is_ee():
        has_permission = await check_action_access(
            user_uid=request.state.user_id,
            project_id=request.state.project_id,
            permission=Permission.VIEW_APPLICATIONS,
        )
        if not has_permission:
            error_msg = "You do not have access to perform this action. Please contact your organization admin."
            return JSONResponse(
                {"detail": error_msg},
                status_code=403,
            )

    cache_key = {
        "app_id": app_id,
    }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.