Authorization removed (ARCH3326)

Key typescript.security.authorization-removed · Severity error · Category security · CWE CWE-862

Merge requests only. Compares each changed endpoint with its version on the target branch and flags one that became less protected: on NestJS controllers a guard removed (@UseGuards or a composite decorator applying it), a public decorator added or a requirement decorator (@Roles …) dropped; on Express-style routes an authentication middleware removed from the route or from router.use; on NestJS middleware consumers a route dropped from forRoutes or added to exclude. Guards, public markers, requirements and authentication middleware are recognised from the repository’s own code (SetMetadata, 401/403 answers, UnauthorizedException, passport.authenticate), not from names. On Next.js: a path added to a middleware list that lets requests skip authentication, or removed from one that leads to a 401 / 403 check - the list’s direction is traced through the code, never read from its name; a path the middleware matcher stops covering; a route handler (app/**/route.ts, pages/api) that stopped checking the session or token. An open endpoint on its own is not a finding; the change that opened it is.

Incorrect

@Controller("orders")
export class OrdersController {
  @UseGuards(AuthGuard("jwt"), RolesGuard)
  @Roles("admin")
  @Delete(":id")
  remove(@Param("id") id: string) { return this.orders.remove(id); }
}

Correct

@Controller("orders")
export class OrdersController {
  @UseGuards(AuthGuard("jwt"), RolesGuard)
  @Roles("admin")
  @Delete(":id")
  remove(@Param("id") id: string) { return this.orders.remove(id); }
}