spikerj/spikersoft-issues
1
0
Fork 0
Code Issues 196 Pull Requests Actions Packages Projects Releases Wiki Activity

[Bug] /keycloak-admin is reachable by any authenticated account — AuthGuard only, no RoleGuard #340

New Issue
Closed
opened 2026-07-03 17:37:41 +00:00 by spikerj · 2 comments
spikerj commented 2026-07-03 17:37:41 +00:00
Owner
Copy Link
Copy Source

Found by the E2E route-coverage reporter (epic #307, P0 #313).

Symptom

projects/spikersoft/src/routes.ts declares /keycloak-admin with canActivate: [AuthGuard] only. Every other staff surface (/admin/*) carries [AuthGuard, RoleGuard] + data.roles: ["Admin","admin","Staff","staff"]. Any signed-in account — including a child/student account — can load the Keycloak admin UI shell and its 12 named-outlet views (users, groups, roles, clients, realm-settings, realm-events, identity-providers, authentication, events).

Impact

Client-side only if the Keycloak REST calls the component makes are properly rejected server-side for non-admin tokens — but that defense-in-depth gap means students see the admin shell, and any backend authz slip becomes fully exploitable. This is a minors'-data platform; the admin surface enumerating users/groups must not render for non-staff.

Fix

Add RoleGuard + data.roles to the /keycloak-admin route (one-line parity with the /admin/* routes). Overlaps with #298 (specialize keycloak-admin toward staff roles & permission delineation) — either land the guard as a fast fix ahead of #298 or fold it into that work.

The e2e route manifest currently classifies /keycloak-admin as auth to match the declared guards (route-coverage gate); flip it to admin when the guard lands.

Part of epic #307.

Found by the E2E route-coverage reporter (epic #307, P0 #313). ## Symptom `projects/spikersoft/src/routes.ts` declares `/keycloak-admin` with `canActivate: [AuthGuard]` only. Every other staff surface (`/admin/*`) carries `[AuthGuard, RoleGuard]` + `data.roles: ["Admin","admin","Staff","staff"]`. Any signed-in account — including a child/student account — can load the Keycloak admin UI shell and its 12 named-outlet views (users, groups, roles, clients, realm-settings, realm-events, identity-providers, authentication, events). ## Impact Client-side only if the Keycloak REST calls the component makes are properly rejected server-side for non-admin tokens — but that defense-in-depth gap means students see the admin shell, and any backend authz slip becomes fully exploitable. This is a minors'-data platform; the admin surface enumerating users/groups must not render for non-staff. ## Fix Add `RoleGuard` + `data.roles` to the `/keycloak-admin` route (one-line parity with the `/admin/*` routes). Overlaps with #298 (specialize keycloak-admin toward staff roles & permission delineation) — either land the guard as a fast fix ahead of #298 or fold it into that work. The e2e route manifest currently classifies `/keycloak-admin` as `auth` to match the declared guards (route-coverage gate); flip it to `admin` when the guard lands. Part of epic #307.
spikerj added the bug label 2026-07-03 17:37:41 +00:00
spikerj commented 2026-07-03 19:55:53 +00:00
Author
Owner
Copy Link
Copy Source

Fix open: spikersoft-angular PR #108 — RoleGuard + data.roles added to /keycloak-admin (parity with /admin/*), manifest classification flipped auth → admin in the same change so the route-coverage drift gate stays green. Will close after merge per the tracker workflow.

Fix open: spikersoft-angular PR #108 — `RoleGuard` + `data.roles` added to `/keycloak-admin` (parity with `/admin/*`), manifest classification flipped `auth` → `admin` in the same change so the route-coverage drift gate stays green. Will close after merge per the tracker workflow.
spikerj commented 2026-07-03 20:03:03 +00:00
Author
Owner
Copy Link
Copy Source

Resolved in spikersoft-angular PR #108 (merged to master). /keycloak-admin now carries RoleGuard + data.roles (parity with /admin/*), and the E2E manifest classifies it admin. Server-side authz hardening for the underlying Keycloak REST calls remains tracked in #298. Closing.

Resolved in spikersoft-angular PR #108 (merged to `master`). `/keycloak-admin` now carries `RoleGuard` + `data.roles` (parity with `/admin/*`), and the E2E manifest classifies it `admin`. Server-side authz hardening for the underlying Keycloak REST calls remains tracked in #298. Closing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agentic
Actionable surfaced by the agentic architecture & security review
 bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 sonarqube
Code quality issue surfaced by SonarQube (bug / code smell)
 wontfix
This won't be fixed
No labels bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
spikerj (Joseph Spiker)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#340