Enforce authorization on every endpoint (default-deny + complete @PreAuthorize coverage)#2521

Merged

p-hoffmann merged 21 commits into

p-hoffmann/security

Jun 20, 2026

Commits on Jun 19, 2026

fix(security): require authentication for all endpoints except login allow-list
p-hoffmann
committed
test(security): regression test that anonymous requests get 401
p-hoffmann
committed
fix(security): require admin:cache for cache endpoints
p-hoffmann
committed
fix(security): require admin:tags for tag mutations
p-hoffmann
committed
fix(security): require admin:tools for tool mutations
p-hoffmann
committed
fix(security): require admin:security for user-import endpoints
p-hoffmann
committed
fix(security): apply admin:security per HTTP handler, not class-level
p-hoffmann
committed
docs(security): document defaultGlobalReadPermissions in application.yaml
p-hoffmann
committed
test(security): harness for per-source authorization (limited user)
p-hoffmann
committed
fix(security): require source access for cohort sample endpoints
p-hoffmann
committed
fix(security): require source access for cdmresults endpoints
p-hoffmann
committed
fix(security): require admin:cache for global cdmresults cache clear
p-hoffmann
committed
fix(security): require source access for vocabulary endpoints
p-hoffmann
committed
fix(security): require source access for evidence endpoints
p-hoffmann
committed
fix(security): require admin for statistic endpoints
p-hoffmann
committed
fix(security): route internal callers to ungated vocabulary/treemap methods
p-hoffmann
committed