Guided review

A review that starts with the risky files.

Stett scores each file for risk, groups the diff into steps and keeps track of what you have reviewed. Big diffs come in pages, and every file in the tree carries its risk badge.

Guided review

Review what's critical first.

Risk first, in steps, with answers beside the code. Reviews take less time and miss less.

PR OverviewNext PR

#14818WalkthroughFile by fileAll filesAI reviewSubmit reviewMerge

fix(backend/api): make v2 permissions match what each endpoint reaches

Tobias Reyeson

platform· 0/9 groups reviewed · 0/17 files reviewed ·Review required

See file treeSee PR overviewAdd review notes

Closes six permission escalation holes in v2 API endpoints where credentials could reach beyond their granted scopes.
Search now requires appropriate scopes for private content types, MCP tools that spend platform resources require USE_TOOLS, and credential deletion blocks platform-managed ones.
Auth caching prevents repeated hash verification, and comprehensive tests pin each fix in place.

In this PR

Auth Caching InfrastructureSearch Content Type PermissionsMCP Tool Permission RequirementsCredential Deletion ProtectionInvoice Sharing Permission AlignmentPublic Schema Metrics VisibilityPermission Enforcement TestsAPI Documentation UpdatesSchema Permission Definition

1.Auth Caching Infrastructure

0 of 3 files reviewed

Mark 3 files reviewed

Risk 7middleware.py

Modifies auth middleware to prevent double verification and fix rate limiting.

Worth readingFastAPI: Security dependencies↗api_key.py↗

… / api / external

global_rate_limit.py6

tenancy.py6

middleware.py7

…backend/backend/api/external/middleware.pyModified+19-2Viewed

@@ -1,12 +1,11 @@

0101 from fastapi import FastAPI, HTTPException, Security, status

0202 from fastapi.security import APIKeyHeader, HTTPAuthorizationCredentials, HTTPBearer

0303 from prisma.enums import APIKeyPermission

04−from starlette.requests import Request

04+from starlette.types import Scope

0505

0606 from backend.data.auth.api_key import validate_api_key

07−from backend.data.auth.api_key import verify_api_key_hash

0807 from backend.data.auth.base import APIAuthorizationInfo

0908 from backend.data.auth.oauth import (

1009 InvalidClientError,

1110 InvalidTokenError,

1211 validate_access_token,

@@ -15,6 +14,8 @@

)

Review in steps1/9 groups · 4/17 files

1.Auth Caching Infrastructure
3/3
2.Search Content Type Permissions
1/2
api/v2/search.pyRisk 8
tests/test_search_scopes.pyRisk 3
Mark 2 files reviewed
3.MCP Tool Permission Requirements
2 files
4.Credential Deletion Protection
1 file
5.Invoice Sharing Permission Alignment
2 files
and 4 more steps

Unblock your team's pull requests.

Install the GitHub App on your org and Team is free for 14 days. No card.

Send this to your GitHub admin

Guided review

A review that starts with the risky files.

Stett scores each file for risk, groups the diff into steps and keeps track of what you have reviewed. Big diffs come in pages, and every file in the tree carries its risk badge.

Guided review

Review what's critical first.

Risk first, in steps, with answers beside the code. Reviews take less time and miss less.

PR OverviewNext PR

#14818WalkthroughFile by fileAll filesAI reviewSubmit reviewMerge

fix(backend/api): make v2 permissions match what each endpoint reaches

Tobias Reyeson

platform· 0/9 groups reviewed · 0/17 files reviewed ·Review required

See file treeSee PR overviewAdd review notes

Closes six permission escalation holes in v2 API endpoints where credentials could reach beyond their granted scopes.
Search now requires appropriate scopes for private content types, MCP tools that spend platform resources require USE_TOOLS, and credential deletion blocks platform-managed ones.
Auth caching prevents repeated hash verification, and comprehensive tests pin each fix in place.

In this PR

1.Auth Caching Infrastructure

0 of 3 files reviewed

Mark 3 files reviewed

Risk 7middleware.py

Modifies auth middleware to prevent double verification and fix rate limiting.

Worth readingFastAPI: Security dependencies↗api_key.py↗

… / api / external

global_rate_limit.py6

tenancy.py6

middleware.py7

…backend/backend/api/external/middleware.pyModified+19-2Viewed

@@ -1,12 +1,11 @@

0101 from fastapi import FastAPI, HTTPException, Security, status

0202 from fastapi.security import APIKeyHeader, HTTPAuthorizationCredentials, HTTPBearer

0303 from prisma.enums import APIKeyPermission

04−from starlette.requests import Request

04+from starlette.types import Scope

0505

0606 from backend.data.auth.api_key import validate_api_key

07−from backend.data.auth.api_key import verify_api_key_hash

0807 from backend.data.auth.base import APIAuthorizationInfo

0908 from backend.data.auth.oauth import (

1009 InvalidClientError,

1110 InvalidTokenError,

1211 validate_access_token,

@@ -15,6 +14,8 @@

)

Review in steps1/9 groups · 4/17 files

1.Auth Caching Infrastructure
3/3
2.Search Content Type Permissions
1/2
api/v2/search.pyRisk 8
tests/test_search_scopes.pyRisk 3
Mark 2 files reviewed
3.MCP Tool Permission Requirements
2 files
4.Credential Deletion Protection
1 file
5.Invoice Sharing Permission Alignment
2 files
and 4 more steps

Unblock your team's pull requests.

Install the GitHub App on your org and Team is free for 14 days. No card.

Send this to your GitHub admin