fix: add missing authorization check to fingerprint endpoint
Proposed changes (including videos or screenshots)
The POST /api/v1/fingerprint endpoint was protected by authRequired: true but had no permissionsRequired check. The endpoint is still actively used as part of the deployment fingerprint change flow.
Fix: add permissionsRequired: ['manage-cloud'] to the endpoint options, matching the authorization pattern used by every other cloud management endpoint in cloud.ts. The manage-cloud permission is assigned to the admin role by default, so the legitimate flow is unaffected.
The 403 response code is also added to the endpoint's response schema, which was missing.
Issue(s)
Steps to test or reproduce
Before the fix:
- Call
POST /api/v1/fingerprintas a user without themanage-cloudpermission -> returns200
After the fix:
- Call
POST /api/v1/fingerprintas a user without themanage-cloudpermission -> expect403 Forbidden - Call
POST /api/v1/fingerprintas a user with themanage-cloudpermission -> expect200 - Trigger the fingerprint change modal as an admin (change
Site_Urlsetting) -> confirm the modal still works end-to-end
Further comments
The manage-cloud permission was chosen because it is already used by all other cloud management endpoints (cloud.syncWorkspace, cloud.createRegistrationIntent, cloud.getRegistrationStatus, etc.) and is semantically correct for an action that modifies workspace cloud identity.