Authenticated users with no site membership can still read site content via Content APIs

[yacdaniel]

CI Number

No response

Duplicates

• I have searched the existing issues

Latest version

• The issue is in the develop branch
• The issue is in the latest released version
• The issue is in an older release (specified in the ticket)

Describe the issue

A user who belongs only to a no_group group (no site membership, empty global permissions) can successfully call Content APIs that require content_read. Those endpoints return HTTP 200 with content data instead of HTTP 403 Unauthorized.

This happens because Editorial site permission-mappings-config.xml includes a wildcard role:

<role name="*">
  <rule regex=".*">
    <allowed-permissions>
      <permission>content_read</permission>
      <permission>content_search</permission>
      <permission>get_children</permission>
      <!-- also: s3_read, webdav_read, list_plugins, publish_status -->
    </allowed-permissions>
  </rule>
</role>

That * role grants baseline read permissions to any authenticated user, even when they are not a member of the site and have no mapped site role. Mutating Content APIs (write/delete/lock/move/etc.) correctly return 403 for the same user.

Affected endpoints (require content_read, return 200 unexpectedly):

• GET /studio/api/2/content/descriptor
• GET /studio/api/2/content/item_by_path
• POST /studio/api/2/content/sandbox_items_by_path
• POST /studio/api/2/content/{siteId}/children
• GET /studio/api/2/content/item_history
• GET /studio/api/2/content/list_quick_create_content
• POST /studio/api/2/content/get_delete_package
• GET /studio/api/2/content/get_content_by_commit_id
• GET /studio/api/2/content/exists
• GET /studio/api/2/content/{siteId}/history

Steps to reproduce

Steps:

1. In crafter-authoring/data/repos/global/configuration/global-role-mappings-config.xml, add a no_group role mapping:

    <group name="no_group">
      <role>no_group</role>
    </group>

2. In crafter-authoring/data/repos/global/configuration/global-permission-mappings-config.xml, add an empty permission mapping for that role:

<role name="no_group">
  <rule regex="/.*">
    <allowed-permissions>
    </allowed-permissions>
  </rule>
</role>

3. Create a no_group group in Studio.
4. Create a user and assign it only to the no_group group (no site groups / no site membership).
5. Authenticate as that user (session or access token).
6. Call any of the Content APIs listed above against an existing site (e.g. Editorial), using a valid siteId and path such as /site/website/index.xml.
7. Observe the response: HTTP 200 with content/data, instead of HTTP 403 Unauthorized.

Relevant log output

Screenshots and/or videos

No response

[jmendeza]

Can't reproduce in 4.x