Note: This should be addressed once #51 is fixed.
Users with consent:write:any can access consent write endpoints (PUT, DELETE) as in [scopes.go]. For acts like revocation, the portal FE sends the user ID (from the ID token) for ACTION_BY in the request body. The BFF proxies admin routes without transformations.
This may allow users to submit any value as ACTION_BY. Adding authorization validation to the BFF would require maintaining many /admin endpoints and auth logic. This complicates things.
Suggested solution: Make ACTION_BY a request header and have the BFF inject the authenticated user ID from the access token. This is secure and simpler because it avoids handling different request-body formats.
#77
Note: This should be addressed once #51 is fixed.
Users with consent:write:any can access consent write endpoints (PUT, DELETE) as in [scopes.go]. For acts like revocation, the portal FE sends the user ID (from the ID token) for ACTION_BY in the request body. The BFF proxies admin routes without transformations.
This may allow users to submit any value as ACTION_BY. Adding authorization validation to the BFF would require maintaining many /admin endpoints and auth logic. This complicates things.
Suggested solution: Make ACTION_BY a request header and have the BFF inject the authenticated user ID from the access token. This is secure and simpler because it avoids handling different request-body formats.
#77