Authorization removed (ARCH9203)

Key swift.security.authorization-removed · Severity error · Category security · CWE CWE-862

Merge requests only. Compares each changed Vapor route with its version on the target branch and flags one that became less protected: a route registered on a builder that rejects unauthenticated callers (grouped with guardMiddleware() or redirectMiddleware(), a group { } closure, a builder derived from one, or a RouteCollection registered on one) that no longer is. The repository’s own middleware that answers 401 / 403 counts as a guard; an authenticator alone does not (it only identifies a caller when one is present). An open route on its own is not a finding; the change that opened it is, and a route the change itself added is new, not opened.

Incorrect

func routes(_ app: Application) throws {
    let protected = app.grouped(UserToken.authenticator(), User.guardMiddleware())
    protected.get("me") { req in try req.auth.require(User.self) }
    protected.delete("orders", ":id", use: deleteOrder)
    app.delete("orders", ":id", use: deleteOrder)
}

Correct

func routes(_ app: Application) throws {
    let protected = app.grouped(UserToken.authenticator(), User.guardMiddleware())
    protected.get("me") { req in try req.auth.require(User.self) }
    protected.delete("orders", ":id", use: deleteOrder)
}