PRC010 — Admin operation uses only the default security

What it catches

An authenticated operation under an administrative-looking path whose security is exactly that of some regular (non-admin) operation: same alternatives, same schemes, same scopes, in any order. It does not matter whether the requirement is inherited from the spec's default or repeated on every operation.

A path is administrative when one of its segments, split on anything that is not a letter or digit, contains the word admin, internal, debug or management, or its plural: /admin/users, /orgs/{org}/admins, /internal/metrics, /debug-tools/cache. /administrators-guide is not, and neither are parameters: /users/{admin_id} names a user.

Operations with no authentication at all are left to PRC001.

Why it matters

If an admin operation asks only for "a logged-in user", any customer with an account may be able to call it. Broken function level authorization (calling functions meant for another role) is one of the most common ways APIs are abused, and the spec is where the intended difference should be written down.

How to fix it

Give the operation a requirement of its own that only administrators meet, and enforce it on the server:

/admin/orders:
  get:
    security:
      - oauth: [orders:admin]

If the operation really is for every user, rename the path so it does not look administrative.

How to ignore it

If the finding is fine on purpose, write an x-procyon-ignore on the operation, with the reason. The finding is still reported, under Ignored, and no longer fails the run. See ignoring a finding.

/admin/users:
  get:
    x-procyon-ignore:
      - rule: PRC010
        reason: "The admin API is only reachable from the VPN"

Examples

Reported (/admin/users inherits the default):

security:
  - bearer: []
paths:
  /admin/users:
    get: ...

Not reported (/admin/orders asks for an admin scope):

paths:
  /admin/orders:
    get:
      security:
        - oauth: [orders:admin]

Known limits

Procyon cannot see what the server enforces. If the default token already carries roles that the server checks, the finding is a reminder to document that in the spec, for example with a scope.