[Security] Remove anonymous access to Trails mutating endpoints (DELETE /{id}, DELETE /purge) #416

New Issue

2026-07-05T20:24:43Z

spikerj commented

2026-07-05 20:24:43 +00:00

Context: Found during spec verification. A concrete instance of the anonymous-surface EPIC.

Problem: The entire TrailsController is class-level [AllowAnonymous] with no per-action overrides — including the destructive DELETE /api/Trails/{id} and the bulk DELETE /api/Trails/purge?region={r} (soft-delete by region). Anonymous callers can delete shared data.

Evidence:

SpikerSoft.Api/Domain/Trails/TrailsController.cs:29 ([AllowAnonymous] on the class)
:248 (DELETE {id}), :294 (DELETE purge)

Fix: Split the surface — keep the read/geo endpoints anonymous (explore), require [Authorize] (+ role) on create/update/delete/purge. Apply the EPIC's transport pattern.

Acceptance criteria: Anonymous callers can read/query trails; every mutating endpoint requires auth; DELETE /purge is restricted to admin/staff.

Effort: S · Child of the anonymous-surface EPIC (this batch).

**Context:** Found during spec verification. A concrete instance of the anonymous-surface EPIC. **Problem:** The entire `TrailsController` is class-level `[AllowAnonymous]` with no per-action overrides — including the destructive `DELETE /api/Trails/{id}` and the bulk `DELETE /api/Trails/purge?region={r}` (soft-delete by region). Anonymous callers can delete shared data. **Evidence:** - `SpikerSoft.Api/Domain/Trails/TrailsController.cs:29` (`[AllowAnonymous]` on the class) - `:248` (`DELETE {id}`), `:294` (`DELETE purge`) **Fix:** Split the surface — keep the read/geo endpoints anonymous (explore), require `[Authorize]` (+ role) on create/update/delete/purge. Apply the EPIC's transport pattern. **Acceptance criteria:** Anonymous callers can read/query trails; every mutating endpoint requires auth; `DELETE /purge` is restricted to admin/staff. **Effort:** S · Child of the anonymous-surface EPIC (this batch).

spikerj added the agentic label 2026-07-05 20:24:43 +00:00

spikerj referenced this issue

2026-07-05 20:25:06 +00:00

[Epic][Architecture] Anonymous-vs-authenticated surface — explicit public/protected split #417

spikerj commented

2026-07-05 20:25:07 +00:00

Child of the anonymous-vs-authenticated surface epic #417.

spikerj commented

2026-07-06 03:03:33 +00:00

Resolved in spikersoft-backend PR #110 (merged to master). Removed the class-level [AllowAnonymous] on TrailsController; [Authorize] on the destructive DELETE /{id} + DELETE /purge, explicit [AllowAnonymous] on the six public read GETs, POST/PUT left anonymous-by-omission so #415's FallbackPolicy sweeps them. Guarded by TrailsControllerAuthorizationTests (9/9). Closing.

Resolved in spikersoft-backend PR #110 (merged to `master`). Removed the class-level `[AllowAnonymous]` on `TrailsController`; `[Authorize]` on the destructive `DELETE /{id}` + `DELETE /purge`, explicit `[AllowAnonymous]` on the six public read GETs, POST/PUT left anonymous-by-omission so #415's FallbackPolicy sweeps them. Guarded by `TrailsControllerAuthorizationTests` (9/9). Closing.

spikerj closed this issue

2026-07-06 03:04:22 +00:00

spikerj referenced this issue

2026-07-22 02:43:38 +00:00

[GameServer][Bug] Projectile hit checks ignore the previous position (tunneling) and spam Warning-level logs per player per tick — CampZone + DungeonZone #645

spikerj referenced this issue

2026-07-29 15:35:03 +00:00

[GameServer][Bug] Projectile hit checks ignore the previous position (tunneling) and spam Warning-level logs per player per tick — CampZone + DungeonZone #645

Sign in to join this conversation.