Bug/70979 api v3 allows reading writing internal comments when the enable internal comments project setting is disabled

[akabiru]

Ticket

https://community.openproject.org/wp/70979

What are you trying to accomplish?

Fix internal comments authorization bug where the API v3 allows reading/writing internal comments when the enabled_internal_comments project setting is disabled or when the EnterpriseToken doesn't allow it.

• Enforce EnterpriseToken and Project setting checks to API contracts & scope
• Add GET /api/v3/projects/:id/configuration endpoint that returns all global configuration plus enabledInternalComments project setting

What approach did you choose and why?

Enforcement Layer: Added the missing checks at the appropriate layers:

• Reading: The internal_visible scope already checked project setting and permission, but was missing the EnterpriseToken check
• Writing: The CreateNoteContract already checked EnterpriseToken and permission, but was missing the project setting check

Configuration API: Extended the existing Configuration API with a project-scoped endpoint rather than modifying the Capabilities API because:

• Capabilities API is optimized for role/permission lookups - adding project settings would conflate concerns
• The global Configuration API already exposes availableFeatures (enterprise token features)
• A project-scoped configuration endpoint provides a single call for mobile apps to get everything they need

Merge checklist

• Added/updated tests
• Added/updated documentation in Lookbook (patterns, previews, etc)
• Tested major browsers (Chrome, Firefox, Edge, ...)

[Copilot]

Pull request overview

This pull request fixes a security vulnerability where the API v3 allowed reading and writing internal comments even when the enabled_internal_comments project setting was disabled or when the Enterprise Token doesn't support the feature.

Changes:

• Added enterprise token check to the internal_visible scope in WorkPackage::Journalized to prevent reading internal comments when the token doesn't allow it
• Added project setting validation to CreateNoteContract to prevent creating internal comments when disabled at the project level
• Introduced a new /api/v3/projects/:id/configuration endpoint that returns global configuration plus project-specific settings like enabledInternalComments

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
app/models/work_package/journalized.rb	Added EnterpriseToken check to internal_visible scope to enforce authorization when reading internal comments
app/contracts/work_packages/create_note_contract.rb	Added project setting validation to prevent creating internal comments when disabled for the project
lib/api/v3/projects/configuration/project_configuration_api.rb	New API endpoint for project-scoped configuration
lib/api/v3/projects/configuration/project_configuration_representer.rb	Representer for project configuration extending global configuration with project settings
lib/api/v3/workspaces/nested_apis.rb	Mounted ProjectConfigurationAPI under workspaces
lib/api/v3/utilities/path_helper.rb	Added path helper methods for project and workspace configuration endpoints
docs/api/apiv3/paths/project_configuration.yml	OpenAPI documentation for the new project configuration endpoint
docs/api/apiv3/components/schemas/project_configuration_model.yml	Schema definition for project configuration model
docs/api/apiv3/openapi-spec.yml	Updated OpenAPI spec to include new project configuration endpoint and schema
config/locales/en.yml	Added translation for feature_disabled_for_project error message
spec/requests/api/v3/projects/configuration/project_configuration_resource_spec.rb	Comprehensive tests for the new configuration API endpoint
spec/requests/api/v3/activities_by_work_package_resource_spec.rb	Added test for creating internal comments when project setting is disabled
spec/contracts/work_packages/create_note_contract_spec.rb	Added test for project setting validation in contract
spec/models/work_package/work_package_acts_as_journalized_spec.rb	Updated tests to use with_ee flag and verify enterprise token enforcement
spec/services/work_packages/activities_tab/paginator_spec.rb	Updated test to use with_ee flag for internal comments
spec/requests/api/v3/emoji_reactions/emoji_reactions_by_work_package_comments_api_spec.rb	Updated test to use with_ee flag
spec/models/concerns/emoji_reactions/grouped_queries_spec.rb	Updated tests to use with_ee flags
spec/helpers/work_packages_helper_spec.rb	Updated test to use with_ee flag
spec/features/activities/work_package/activities_spec.rb	Updated test suite to use with_ee flag
spec/controllers/work_packages_controller_spec.rb	Updated test to use with_ee flag

[akabiru]

@copilot open a new pull request to apply changes based on the comments in this thread

[Copilot]

@akabiru I've opened a new pull request, #21807, to work on those changes. Once the pull request is ready, I'll request review from you.

[judithroth]

Nice work! I have only one small question about the documentation