fix(security): restrict /monitoring/events to configured administrators (Closes #101) - #163

Closes #101

Problem

GET /monitoring/events in backend/src/routes/system.routes.ts is mounted with requireAccessToken and nothing else. That middleware only proves someone is authenticated — it performs no role or ownership check.

The endpoint returns readRecentMonitoringEvents(), which is the system-wide event log: backend and frontend stack traces, internal filesystem paths, request metadata and user agents for every user of the instance. Any authenticated caller — a regular contributor, a guest session, or anyone holding a bearer token — can read all of it.

Change

backend/src/middleware/auth.ts — adds a requireAdmin middleware backed by a new PROOFDESK_ADMIN_LOGINS variable (comma-separated GitHub logins, matching the existing PROOFDESK_* convention).

It denies in three cases, all deliberately fail-closed:

• the allow-list is empty or unset. An unconfigured allow-list means "no administrators have been designated", never "everyone qualifies";
• there is no authenticated session. requireAccessToken also accepts a raw bearer token, and in that path req.authSession is null — a bearer token on its own carries no verified identity to compare against the list;
• the session login is not on the list.

Logins are compared case-insensitively, matching GitHub's own treatment. The list is parsed per request so an operator can change it without a rebuild.

Identity is read from req.authSession?.user?.login — the same primitive the existing checkWorkspaceOwner middleware already uses, rather than introducing a second notion of identity.

backend/src/routes/system.routes.ts — /monitoring/events now runs requireAccessToken, requireAdmin.

.env.example — documents the new variable.

Compatibility

Nothing in the repository reads /monitoring/events — the only occurrence of that path anywhere is the route definition itself. The frontend posts to /monitoring/client-error but never reads the event log back. So restricting it removes no existing functionality; an operator who wants access adds their login to PROOFDESK_ADMIN_LOGINS.

Verification

• npx tsc --noEmit in backend/ clean.
• requireAdmin exercised across all seven paths: unset allow-list denies, non-admin denies, admin passes, case-mismatched login passes, bearer-token-without-session denies, session-without-login denies, whitespace-padded multi-entry list passes.

Observation, not addressed here

GET /metrics (line 42 of the same file) has the same shape — requireAccessToken with no role check — and exposes the Prometheus register. I've left it alone since #101 names only /monitoring/events, but if you'd like it under the same guard, say so and I'll add it here or open it separately.

Note: npm test is red on clean main independently of this branch.

Summary by CodeRabbit

• Security
  • Restricted access to monitoring events to approved administrators.
  • Requests without an approved administrator login now receive a 403 response.
  • Added configuration documentation for specifying administrator GitHub logins.