feat: add per-site /{site}/CONFIG permission for site config

Introduce a per-site config permission keyword `/{site}/CONFIG` that
governs reading/writing site config (/config/{org}/{site}/...), mirroring
how the org-level `CONFIG` keyword governs org config (/config/{org}).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: bosschaert

src/routes/config.js

@@ -12,18 +12,18 @@
 
 import putKv from '../storage/kv/put.js';
 import getKv from '../storage/kv/get.js';
-import { hasPermission } from '../utils/auth.js';
+import { configPermissionPath, hasPermission } from '../utils/auth.js';
 
 export async function postConfig({ req, env, daCtx }) {
-  if (!hasPermission(daCtx, 'CONFIG', 'write', true)) {
+  if (!hasPermission(daCtx, configPermissionPath(daCtx), 'write', true)) {
     return { status: 403 };
   }
 
   return putKv(req, env, daCtx);
 }
 
 export async function getConfig({ env, daCtx }) {
-  if (!hasPermission(daCtx, 'CONFIG', 'read', true)) {
+  if (!hasPermission(daCtx, configPermissionPath(daCtx), 'read', true)) {
     return { status: 403 };
   }
 

src/utils/auth.js

@@ -228,6 +228,16 @@ export function pathSorter({ path: path1 }, { path: path2 }) {
   return sp2.length - sp1.length;
 }
 
+/**
+ * The keyword path that governs access to a config resource. Org-level config
+ * (`/config/{org}`) is governed by the `CONFIG` keyword, while site-level config
+ * (`/config/{org}/{site}/...`) is governed by a per-site `/{site}/CONFIG` keyword.
+ * The `CONFIG` portion is always uppercase so it cannot collide with a content path.
+ */
+export function configPermissionPath(daCtx) {
+  return daCtx.site ? `/${daCtx.site}/CONFIG` : 'CONFIG';
+}
+
 export async function getAclCtx(env, org, users, key, api) {
   const pathLookup = new Map();
 
@@ -328,7 +338,10 @@ export async function getAclCtx(env, org, users, key, api) {
   // Do a lookup for the base key, we always need this info
   let k;
   if (api === 'config') {
-    k = 'CONFIG';
+    // Org config (`/config/{org}`) is governed by the `CONFIG` keyword. Site config
+    // (`/config/{org}/{site}/...`) is governed by a per-site `/{site}/CONFIG` keyword.
+    const [site] = key.split('/').filter((part) => part.length > 0);
+    k = site ? `/${site}/CONFIG` : 'CONFIG';
   } else {
     k = key.startsWith('/') ? key : `/${key}`;
   }
@@ -354,7 +367,7 @@ export async function getAclCtx(env, org, users, key, api) {
     ? actionTrace
     : undefined;
 
-  if (k === 'CONFIG' || api === 'versionsource') {
+  if (api === 'config' || api === 'versionsource') {
     actionSet.add('read');
   }
 

test/routes/config.test.js

@@ -75,6 +75,61 @@ describe('Config', () => {
     assert.deepStrictEqual(getKVCalled, [{ e: env, c: ctx }]);
   });
 
+  it('Test postConfig site config uses /{site}/CONFIG permission', async () => {
+    const ctx = { site: 'mysite' };
+    const env = {};
+    const req = {};
+
+    const putKVCalled = [];
+    const putKV = async (r, q, c) => {
+      putKVCalled.push({ r, q, c });
+      return 'called';
+    };
+
+    const hasPermission = (c, k, a, kw) => k === '/mysite/CONFIG' && a === 'write' && kw === true;
+
+    const { postConfig } = await esmock('../../src/routes/config.js', {
+      '../../src/storage/kv/put.js': {
+        default: putKV,
+      },
+      '../../src/utils/auth.js': {
+        hasPermission,
+        configPermissionPath: (c) => `/${c.site}/CONFIG`,
+      },
+    });
+
+    const res = await postConfig({ req, env, daCtx: ctx });
+    assert.strictEqual(res, 'called');
+    assert.deepStrictEqual(putKVCalled, [{ r: req, q: env, c: ctx }]);
+  });
+
+  it('Test getConfig site config uses /{site}/CONFIG permission', async () => {
+    const ctx = { site: 'mysite' };
+    const env = {};
+
+    const getKVCalled = [];
+    const getKV = async (e, c) => {
+      getKVCalled.push({ e, c });
+      return 'called';
+    };
+
+    const hasPermission = (c, k, a, kw) => k === '/mysite/CONFIG' && a === 'read' && kw === true;
+
+    const { getConfig } = await esmock('../../src/routes/config.js', {
+      '../../src/storage/kv/get.js': {
+        default: getKV,
+      },
+      '../../src/utils/auth.js': {
+        hasPermission,
+        configPermissionPath: (c) => `/${c.site}/CONFIG`,
+      },
+    });
+
+    const res = await getConfig({ env, daCtx: ctx });
+    assert.strictEqual(res, 'called');
+    assert.deepStrictEqual(getKVCalled, [{ e: env, c: ctx }]);
+  });
+
   it('Test no permission', async () => {
     const ctx = {};
     const env = {};

test/utils/auth.test.js

@@ -19,6 +19,7 @@ import env from './mocks/env.js';
 import jose from './mocks/jose.js';
 import fetch from './mocks/fetch.js';
 import {
+  configPermissionPath,
   getAclCtx,
   getChildRules,
   getUserActions,
@@ -531,6 +532,56 @@ describe('DA auth', () => {
       assert(!aclCtx.actionSet.has('write'));
     });
 
+    it('configPermissionPath returns CONFIG for org config', () => {
+      assert.strictEqual(configPermissionPath({}), 'CONFIG');
+    });
+
+    it('configPermissionPath returns /{site}/CONFIG for site config', () => {
+      assert.strictEqual(configPermissionPath({ site: 'mysite' }), '/mysite/CONFIG');
+    });
+
+    it('test site CONFIG governs site config read', async () => {
+      const siteConfig = {
+        test: {
+          ':type': 'sheet',
+          ':sheetname': 'permissions',
+          data: [
+            { path: '/mysite/CONFIG', groups: 'reader@bloggs.org', actions: 'read' },
+            { path: 'CONFIG', groups: 'orgadmin@bloggs.org', actions: 'write' },
+          ],
+        },
+      };
+      const siteEnv = { DA_CONFIG: { get: (name) => siteConfig[name] } };
+
+      const reader = [{ email: 'reader@bloggs.org' }];
+      const aclCtx = await getAclCtx(siteEnv, 'test', reader, 'mysite/config.json', 'config');
+
+      // The index.js gate always allows reaching the config route for config requests.
+      assert(aclCtx.actionSet.has('read'));
+
+      // The reader can read this site's config.
+      assert(hasPermission({
+        users: reader, org: 'test', aclCtx, key: 'mysite/config.json', site: 'mysite',
+      }, configPermissionPath({ site: 'mysite' }), 'read', true));
+
+      // The reader cannot write this site's config.
+      assert(!hasPermission({
+        users: reader, org: 'test', aclCtx, key: 'mysite/config.json', site: 'mysite',
+      }, configPermissionPath({ site: 'mysite' }), 'write', true));
+
+      // A user without the site CONFIG permission cannot read this site's config.
+      const stranger = [{ email: 'orgadmin@bloggs.org' }];
+      const strangerCtx = await getAclCtx(siteEnv, 'test', stranger, 'mysite/config.json', 'config');
+      assert(!hasPermission({
+        users: stranger, org: 'test', aclCtx: strangerCtx, key: 'mysite/config.json', site: 'mysite',
+      }, configPermissionPath({ site: 'mysite' }), 'read', true));
+
+      // The site CONFIG permission does not grant read on a different site's config.
+      assert(!hasPermission({
+        users: reader, org: 'test', aclCtx, key: 'other/config.json', site: 'other',
+      }, configPermissionPath({ site: 'other' }), 'read', true));
+    });
+
     it('test DA_OPS_IMS_ORG permissions', async () => {
       const opsOrg = 'MyOpsOrg';
       const envOps = {