From 9f139da0638814a27aecac0db91d9d82ed63be8f Mon Sep 17 00:00:00 2001 From: Roberto Jimenez Sanchez Date: Wed, 17 Dec 2025 15:43:33 +0100 Subject: [PATCH] provisioning: fix settings/stats authorization for AccessPolicy identities The settings and stats endpoints were returning 403 for users accessing via ST->MT because the AccessPolicy identity was routed to the access checker, which doesn't know about these resources. This fix handles 'settings' and 'stats' resources before the access checker path, routing them to the role-based authorization that allows: - settings: Viewer role (read-only, needed by frontend) - stats: Admin role (can leak information) --- pkg/registry/apis/provisioning/register.go | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/pkg/registry/apis/provisioning/register.go b/pkg/registry/apis/provisioning/register.go index b479dc3f8c8..cf30a55e0af 100644 --- a/pkg/registry/apis/provisioning/register.go +++ b/pkg/registry/apis/provisioning/register.go @@ -300,6 +300,17 @@ func (b *APIBuilder) GetAuthorizer() authorizer.Authorizer { } } + // Handle read-only resources that use role-based authorization. + // These resources are not registered in the access checker, so we handle them separately. + // This allows the frontend to access settings without requiring explicit permissions. + if a.GetResource() == "settings" || a.GetResource() == "stats" { + id, err := identity.GetRequester(ctx) + if err != nil { + return authorizer.DecisionDeny, "failed to find requester", err + } + return b.authorizeResource(ctx, a, id) + } + info, ok := authlib.AuthInfoFrom(ctx) // when running as standalone API server, the identity type may not always match TypeAccessPolicy // so we allow it to use the access checker if there is any auth info available