fix: attachments.redirect should be considered in read scope. (#13155)

closes #13152

server/middlewares/authentication.ts

@@ -1,5 +1,6 @@
 import type { Next } from "koa";
 import { capitalize } from "es-toolkit/compat";
+import httpErrors from "http-errors";
 import type { UserRole } from "@shared/types";
 import { UserRoleHelper } from "@shared/utils/UserRoleHelper";
 import tracer, {
@@ -64,7 +65,9 @@ export default function auth(options: AuthenticationOptions = {}) {
         );
       }
     } catch (err) {
-      if (options.optional) {
+      // Credentials that are valid but insufficient are always surfaced,
+      // otherwise the request would be silently downgraded to anonymous.
+      if (options.optional && !(err instanceof httpErrors.Forbidden)) {
         ctx.state.auth = {};
       } else {
         throw err;

shared/helpers/AuthenticationHelper.test.ts

@@ -93,6 +93,15 @@ describe("AuthenticationHelper", () => {
         expect(canAccess("/api/documents.memberships", scopes)).toBe(false);
       });
 
+      it("attachments read scope grants access to redirect", async () => {
+        const scopes = ["attachments:read"];
+
+        expect(canAccess("/api/attachments.info", scopes)).toBe(true);
+        expect(canAccess("/api/attachments.redirect", scopes)).toBe(true);
+        expect(canAccess("/api/attachments.create", scopes)).toBe(false);
+        expect(canAccess("/api/attachments.delete", scopes)).toBe(false);
+      });
+
       it("write", async () => {
         const scopes = ["documents:write"];
 
@@ -132,6 +141,7 @@ describe("AuthenticationHelper", () => {
         expect(canAccess("/api/collections.group_memberships", scopes)).toBe(
           true
         );
+        expect(canAccess("/api/attachments.redirect", scopes)).toBe(true);
         expect(canAccess("/api/documents.create", scopes)).toBe(false);
         expect(canAccess("/api/documents.update", scopes)).toBe(false);
         expect(canAccess("/api/users.create", scopes)).toBe(false);

shared/helpers/AuthenticationHelper.ts

@@ -10,6 +10,7 @@ export default class AuthenticationHelper {
    * - `documents.info` -> `Scope.Read`
    * - `collections.memberships` -> `Scope.Read`
    * - `collections.group_memberships` -> `Scope.Read`
+   * - `attachments.redirect` -> `Scope.Read`
    */
   private static methodToScope = {
     create: Scope.Create,
@@ -21,6 +22,7 @@ export default class AuthenticationHelper {
     drafts: Scope.Read,
     viewed: Scope.Read,
     export: Scope.Read,
+    redirect: Scope.Read,
     memberships: Scope.Read,
     group_memberships: Scope.Read,
   };