fix: refresh chart for team user

[dennisvankekem]

No description provided.

[Copilot]

Pull request overview

Updates the OpenAPI authorization metadata so team-scoped users can call the /v2/catalogs/refresh endpoint by switching the operation’s ACL schema to a dedicated refresh schema with broader permissions.

Changes:

• Changed /v2/catalogs/refresh to use x-aclSchema: AplCatalogRefresh instead of AplCatalog.
• Added new AplCatalogRefresh schema with x-acl rules granting create-any to platform admins, team admins, and team members.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (3)

src/openapi/api.yaml:2463

• teamMember: [create-any] and teamAdmin: [create-any] generate CASL rules without teamId conditions (see src/authz.ts rule creation for *-any), and this endpoint also has no teamId parameter. That means any authenticated team member can call POST /v2/catalogs/refresh regardless of team context, and—when catalogId is omitted—trigger a refresh of all enabled catalogs, which can be expensive (iterates catalogs and fetches each repo). If the intent is not to expose a global refresh to all team members, restrict this to admins only, or introduce a team-scoped refresh mechanism (e.g., add teamId scoping and use non-*-any permissions).

      x-acl:
        platformAdmin: [create-any]
        teamAdmin: [create-any]
        teamMember: [create-any]

src/openapi/api.yaml:1389

• Because catalogId is optional, any caller who is authorized for this operation can trigger a refresh of all enabled catalogs by omitting it. With the new ACL allowing team members, this becomes an easy way to cause repeated expensive refresh work. Consider requiring catalogId so this endpoint only refreshes a single cache per call (and reserve full refresh for a more restricted/admin-only path).

      x-aclSchema: AplCatalogRefresh
      parameters:
        - name: catalogId
          in: query
          description: Optional catalog name to refresh a single cache; when omitted all enabled catalogs are refreshed

src/openapi/api.yaml:1385

• This change materially alters authorization for POST /v2/catalogs/refresh (team members can now call it). There are existing V2 authz tests (src/api-v2.authz.test.ts), but none cover this endpoint; adding cases for teamMember/teamAdmin/platformAdmin (and for the catalogId omitted vs provided behavior) would help prevent accidental privilege/behavior regressions.

      x-aclSchema: AplCatalogRefresh

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/openapi/api.yaml:2463

• teamMember: [create-any] makes this refresh operation effectively unscoped: /v2/catalogs/refresh has no teamId parameter, so authorize() passes teamId = undefined, and CASL *-any rules are created without teamId conditions. Combined with catalogId being optional (so the handler refreshes all catalogs when omitted), any authenticated team member can trigger a global cache refresh, which is a high-impact operation.

Consider restricting this to teamAdmin/platformAdmin only, or make the operation truly team-scoped (include a required teamId in the API and update the handler to refresh only that team’s cache) so non-*-any permissions can be used.

      type: object
      x-acl:
        platformAdmin: [create-any]
        teamAdmin: [create-any]
        teamMember: [create-any]

src/openapi/api.yaml:1386

• This PR changes authz behavior for POST /v2/catalogs/refresh by switching to a new x-aclSchema with create-any permissions. The repo has dedicated authz test suites (e.g. src/api-v2.authz.test.ts), but this endpoint is not currently covered. Add/adjust tests to assert which roles should be allowed/forbidden (and ideally that team members cannot trigger a global refresh if that’s not intended).

      operationId: refreshAplCatalogCache
      x-eov-operation-handler: v2/catalogs/refresh
      description: Refresh BYO catalog cache(s)
      x-aclSchema: AplCatalogRefresh
      parameters:

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

src/openapi/api.yaml:2463

• AplCatalogRefresh grants teamMember: [create-any]. Because *-any rules are generated without teamId conditions (see src/authz.ts:151-160) and /v2/catalogs/refresh has no teamId param, this allows any authenticated team member to trigger a global refresh (and the handler refreshes all enabled catalogs when catalogId is omitted). This is a potentially high-impact operation; consider restricting to teamAdmin/platformAdmin only, or making the refresh request team- or catalog-scoped (e.g., require catalogId and/or add teamId so non-*-any permissions can be used).

      type: object
      x-acl:
        platformAdmin: [create-any]
        teamAdmin: [create-any]
        teamMember: [create-any]