Found out of scope by the #13160 dev (PR #13213) while driving every mounted route of RestServer under an absent execution context. ⛔ Reported, not touched — access-control behaviour is a human floor, and this is outside that card by construction (it is not a resolveExecCtx consumer, which is exactly why the census surfaced it: it is the one metadata-touching route in the table that resolves no identity at all).
⛔ Ungraded and unrouted. Severity not judged here.
Measured
packages/rest/src/rest-server.ts, registerUiEndpoints (the handler for GET /api/v1/ui/view/:object/:type):
- it calls
this.resolveProtocol(...) and then p.getUiView({ object, type, environmentId }); - it does not call
this.resolveExecCtx; - it does not call
this.enforceAuth; - it passes no execution context to
getUiView, so the protocol cannot apply RLS/FLS/tenant scoping on the caller's behalf.
Driven on the real registerRoutes() route table with a stub protocol: the route answers 200 identically with an absent context and with an entitled one, and records zero resolveExecCtx calls. Every other identity-touching route in that table answers 401 UNAUTHENTICATED under an absent context (that is PR #13213's census, 52 of 52 plus the metadata umbrella).
⚠️ What is NOT measured
Whether getUiView applies authorization of its own downstream. The reading above is about the REST seam only. It is entirely possible this route is deliberately public, or gated inside the protocol — neither was checked, and ⛔ this card asserts no vulnerability.
Two specific things worth checking before grading:
isAuthGateAllowlisted (packages/core/src/security/auth-gate.ts) does not name a /ui path, so this is not the declared control-plane exemption.packages/qa/dogfood/test/authz-conformance.matrix.ts carries no row for this route. Its header says a new ungated route is UNCLASSIFIED and breaks CI — so either discover()'s curated per-file probe table does not reach registerUiEndpoints, or this route is covered by a row that does not name it. Which of those is true decides whether this is a route gap or a ratchet gap, and the second would be the larger finding.
Re-check
git grep -n "registerUiEndpoints" -- packages/rest/src/rest-server.ts
git grep -n "getUiView" -- packages/rest/src packages/qa
git grep -n "ui" -- packages/core/src/security/auth-gate.ts
⛔ Reverse-check any zero with a term known present in the same file — enforceAuth is present in rest-server.ts and registerUiEndpoints sits directly above registerCrudEndpoints, whose handlers all carry the guard.
Refs
Found out of scope by the #13160 dev (PR #13213) while driving every mounted route of
RestServerunder an absent execution context. ⛔ Reported, not touched — access-control behaviour is a human floor, and this is outside that card by construction (it is not aresolveExecCtxconsumer, which is exactly why the census surfaced it: it is the one metadata-touching route in the table that resolves no identity at all).⛔ Ungraded and unrouted. Severity not judged here.
Measured
packages/rest/src/rest-server.ts,registerUiEndpoints(the handler forGET /api/v1/ui/view/:object/:type):this.resolveProtocol(...)and thenp.getUiView({ object, type, environmentId });this.resolveExecCtx;this.enforceAuth;getUiView, so the protocol cannot apply RLS/FLS/tenant scoping on the caller's behalf.Driven on the real
registerRoutes()route table with a stub protocol: the route answers 200 identically with an absent context and with an entitled one, and records zeroresolveExecCtxcalls. Every other identity-touching route in that table answers 401UNAUTHENTICATEDunder an absent context (that is PR #13213's census, 52 of 52 plus the metadata umbrella).Whether
getUiViewapplies authorization of its own downstream. The reading above is about the REST seam only. It is entirely possible this route is deliberately public, or gated inside the protocol — neither was checked, and ⛔ this card asserts no vulnerability.Two specific things worth checking before grading:
isAuthGateAllowlisted(packages/core/src/security/auth-gate.ts) does not name a/uipath, so this is not the declared control-plane exemption.packages/qa/dogfood/test/authz-conformance.matrix.tscarries no row for this route. Its header says a new ungated route is UNCLASSIFIED and breaks CI — so eitherdiscover()'s curated per-file probe table does not reachregisterUiEndpoints, or this route is covered by a row that does not name it. Which of those is true decides whether this is a route gap or a ratchet gap, and the second would be the larger finding.Re-check
⛔ Reverse-check any zero with a term known present in the same file —
enforceAuthis present inrest-server.tsandregisterUiEndpointssits directly aboveregisterCrudEndpoints, whose handlers all carry the guard.Refs
computeExecCtxswallows EVERY fault into an anonymous context for all 72resolveExecCtxcall sites — measured fail-closed at exactly one door, unmeasured at the rest #13160 / PR test(rest): census what an absent execution context means at all 72 resolveExecCtx consumers #13213 — the census that surfaced this, and the method (drive the route, read the decision off the response)resolveExecutionContextseam is TEST-ONLY —resolveExecCtxisprivate asyncbehind.catch(() => undefined), so no production throw leaves it #12537 / PR test(rest): measure what a swallowed execution context reads as at the packages door #13153 — the packages door, where the swallowed-context reading was first measured