[PR #5916] [MERGED] fix(backend): enforce user ownership when deleting PAT #5411

New issue

Closed

opened 2026-03-17 02:51:45 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:51:45 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/5916
Author: @mirarifhasan
Created: 2/28/2026
Status: ✅ Merged
Merged: 3/2/2026
Merged by: @jamesgeorge007

Base: patch ← Head: fix/security-advisory-GHSA-7pfq-mwj3-xw9h

📝 Commits (3)

7134624 fix: enforce user ownership when deleting PAT
36dc583 chore: validate PAT id; use deleteMany in service
ac8c021 test(backend): add cross-user ownership test for deletePAT

📊 Changes

3 files changed (+55 additions, -17 deletions)

View changed files

📝 packages/hoppscotch-backend/src/access-token/access-token.controller.ts (+8 -2)
📝 packages/hoppscotch-backend/src/access-token/access-token.service.spec.ts (+38 -8)
📝 packages/hoppscotch-backend/src/access-token/access-token.service.ts (+9 -7)

📄 Description

Closes BE-727

What's changed

This PR closing security advisory:
https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-7pfq-mwj3-xw9h

Require the authenticated user's UID when deleting a personal access token. The controller now injects GqlUser and forwards user.uid to AccessTokenService.deletePAT; the service signature was updated to accept userUid and restrict the delete query to { id, userUid } to prevent deleting tokens belonging to other users. Tests were updated to pass the user UID.

Notes to reviewers

Nil

Summary by cubic

Enforces user ownership and validates input when deleting a personal access token to prevent cross-user or invalid deletions. Fixes GHSA-7pfq-mwj3-xw9h and closes BE-727.

Bug Fixes
- Require authenticated user UID in the revoke endpoint (inject GqlUser).
- Validate PAT id; return 400 if missing.
- Use deleteMany on { id, userUid } and check count; return 404 if not found or belongs to another user.
- Add test covering cross-user ownership (IDOR) case.

^{Written for commit ac8c0217b8. Summary will update on new commits.}

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/5916 **Author:** [@mirarifhasan](https://github.com/mirarifhasan) **Created:** 2/28/2026 **Status:** ✅ Merged **Merged:** 3/2/2026 **Merged by:** [@jamesgeorge007](https://github.com/jamesgeorge007) **Base:** `patch` ← **Head:** `fix/security-advisory-GHSA-7pfq-mwj3-xw9h` --- ### 📝 Commits (3) - [`7134624`](https://github.com/hoppscotch/hoppscotch/commit/7134624b06342d74d9e8543bccfe49d8665f6c21) fix: enforce user ownership when deleting PAT - [`36dc583`](https://github.com/hoppscotch/hoppscotch/commit/36dc583a95156a09653d84b9db04ff187bf76788) chore: validate PAT id; use deleteMany in service - [`ac8c021`](https://github.com/hoppscotch/hoppscotch/commit/ac8c0217b8323fcccc5bb5d243c608f875849dbb) test(backend): add cross-user ownership test for `deletePAT` ### 📊 Changes **3 files changed** (+55 additions, -17 deletions) <details> <summary>View changed files</summary> 📝 `packages/hoppscotch-backend/src/access-token/access-token.controller.ts` (+8 -2) 📝 `packages/hoppscotch-backend/src/access-token/access-token.service.spec.ts` (+38 -8) 📝 `packages/hoppscotch-backend/src/access-token/access-token.service.ts` (+9 -7) </details> ### 📄 Description    Closes BE-727  ### What's changed  This PR closing security advisory: https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-7pfq-mwj3-xw9h Require the authenticated user's UID when deleting a personal access token. The controller now injects `GqlUser` and forwards `user.uid` to `AccessTokenService.deletePAT`; the service signature was updated to accept `userUid` and restrict the `delete` query to `{ id, userUid }` to prevent deleting tokens belonging to other users. Tests were updated to pass the user UID.  ### Notes to reviewers  Nil  --- ## Summary by cubic Enforces user ownership and validates input when deleting a personal access token to prevent cross-user or invalid deletions. Fixes GHSA-7pfq-mwj3-xw9h and closes BE-727. - **Bug Fixes** - Require authenticated user UID in the revoke endpoint (inject GqlUser). - Validate PAT id; return 400 if missing. - Use deleteMany on { id, userUid } and check count; return 404 if not found or belongs to another user. - Add test covering cross-user ownership (IDOR) case. <sup>Written for commit ac8c0217b8323fcccc5bb5d243c608f875849dbb. Summary will update on new commits.</sup>  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>