>_
.issue.db
/highway
Dashboard
Issues
Memory
Lessons
Audit Log
New Issue
Edit Issue #1016
Update issue details
Title *
Description
EARS: When GET /api/v1/gateway/approvals/<approval_id>/respond validates a signed token, the API shall require the token's approval id (consume_approval_token result) to equal the path approval_id as a UUID; if not, it shall roll back (token unconsumed) and return 400 'Invalid token' without approving or rejecting. Found during #1010: validate_token never compared the token's approval id with the path, so a valid link for approval A could approve/reject any approval B in the same tenant. Fixed in the #1010 change (api/blueprints/v1/gateway_approvals.py _same_approval); unit tests in tests/unit/api/test_gateway_html_escape_1010.py.
Priority
Low
Medium
High
Critical
Status
Open
In Progress
Closed
Won't Do
Due Date (YYYY-MM-DD)
Tags (comma separated)
Related Issues (IDs)
Enter IDs of issues related to this one. They will be linked as 'related'.
Update Issue
Cancel