From 412c72b5f37ce009e70ee7c51010db192279bc3b Mon Sep 17 00:00:00 2001
From: loks0n <22452787+loks0n@users.noreply.github.com>
Date: Wed, 14 Feb 2024 10:47:53 +0000
Subject: [PATCH] chore: revert ssr scopes

---
 app/config/roles.php               |  8 +---
 app/config/scopes.php              |  9 ----
 app/controllers/api/account.php    | 76 +++++++++++++++---------------
 tests/e2e/Scopes/ProjectCustom.php |  5 +-
 4 files changed, 42 insertions(+), 56 deletions(-)

diff --git a/app/config/roles.php b/app/config/roles.php
index 2aaee563c8..f20477486c 100644
--- a/app/config/roles.php
+++ b/app/config/roles.php
@@ -8,9 +8,7 @@ $member = [
     'home',
     'console',
     'graphql',
-    'sessions.write',
-    'accounts.read',
-    'accounts.write',
+    'account',
     'teams.read',
     'teams.write',
     'documents.read',
@@ -33,7 +31,6 @@ $member = [
 $admins = [
     'global',
     'graphql',
-    'sessions.write',
     'teams.read',
     'teams.write',
     'documents.read',
@@ -88,7 +85,6 @@ return [
             'home',
             'console',
             'graphql',
-            'sessions.write',
             'documents.read',
             'documents.write',
             'files.read',
@@ -116,6 +112,6 @@ return [
     ],
     Auth::USER_ROLE_APPS => [
         'label' => 'Applications',
-        'scopes' => ['global', 'health.read', 'graphql'],
+        'scopes' => ['public', 'global', 'health.read', 'graphql'],
     ],
 ];
diff --git a/app/config/scopes.php b/app/config/scopes.php
index f6b8570917..ddc1de21f3 100644
--- a/app/config/scopes.php
+++ b/app/config/scopes.php
@@ -1,15 +1,6 @@
 <?php
 
 return [ // List of publicly visible scopes
-    'accounts.read' => [
-        'description' => 'Access to read your active user account',
-    ],
-    'accounts.write' => [
-        'description' => 'Access to create, update, and delete your active user account',
-    ],
-    'sessions.write' => [
-        'description' => 'Access to create, update, and delete user sessions',
-    ],
     'users.read' => [
         'description' => 'Access to read your project\'s users',
     ],
diff --git a/app/controllers/api/account.php b/app/controllers/api/account.php
index 2e970da61f..f06dcad0c5 100644
--- a/app/controllers/api/account.php
+++ b/app/controllers/api/account.php
@@ -61,7 +61,7 @@ App::post('/v1/account')
     ->desc('Create account')
     ->groups(['api', 'account', 'auth'])
     ->label('event', 'users.[userId].create')
-    ->label('scope', 'sessions.write')
+    ->label('scope', 'public')
     ->label('auth.type', 'emailPassword')
     ->label('audits.event', 'user.create')
     ->label('audits.resource', 'user/{response.$id}')
@@ -197,7 +197,7 @@ App::post('/v1/account/sessions/email')
     ->desc('Create email password session')
     ->groups(['api', 'account', 'auth', 'session'])
     ->label('event', 'users.[userId].sessions.[sessionId].create')
-    ->label('scope', 'sessions.write')
+    ->label('scope', 'public')
     ->label('auth.type', 'emailPassword')
     ->label('audits.event', 'session.create')
     ->label('audits.resource', 'user/{response.userId}')
@@ -323,7 +323,7 @@ App::get('/v1/account/sessions/oauth2/:provider')
     ->desc('Create OAuth2 session')
     ->groups(['api', 'account'])
     ->label('error', __DIR__ . '/../../views/general/error.phtml')
-    ->label('scope', 'sessions.write')
+    ->label('scope', 'public')
     ->label('sdk.auth', [])
     ->label('sdk.hideServer', true)
     ->label('sdk.namespace', 'account')
@@ -893,7 +893,7 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect')
 App::get('/v1/account/identities')
     ->desc('List Identities')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.read')
+    ->label('scope', 'public')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
     ->label('sdk.namespace', 'account')
     ->label('sdk.method', 'listIdentities')
@@ -949,7 +949,7 @@ App::get('/v1/account/identities')
 App::delete('/v1/account/identities/:identityId')
     ->desc('Delete identity')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('event', 'users.[userId].identities.[identityId].delete')
     ->label('audits.event', 'identity.delete')
     ->label('audits.resource', 'identity/{request.$identityId}')
@@ -986,7 +986,7 @@ App::post('/v1/account/tokens/magic-url')
     ->alias('/v1/account/sessions/magic-url')
     ->desc('Create magic URL token')
     ->groups(['api', 'account', 'auth'])
-    ->label('scope', 'sessions.write')
+    ->label('scope', 'public')
     ->label('auth.type', 'magic-url')
     ->label('audits.event', 'session.create')
     ->label('audits.resource', 'user/{response.userId}')
@@ -1228,7 +1228,7 @@ App::post('/v1/account/tokens/magic-url')
 App::post('/v1/account/tokens/email')
     ->desc('Create email token (OTP)')
     ->groups(['api', 'account', 'auth'])
-    ->label('scope', 'sessions.write')
+    ->label('scope', 'public')
     ->label('auth.type', 'email-otp')
     ->label('audits.event', 'session.create')
     ->label('audits.resource', 'user/{response.userId}')
@@ -1565,7 +1565,7 @@ App::put('/v1/account/sessions/magic-url')
     ->desc('Create session (deprecated)')
     ->label('event', 'users.[userId].sessions.[sessionId].create')
     ->groups(['api', 'account'])
-    ->label('scope', 'sessions.write')
+    ->label('scope', 'public')
     ->label('audits.event', 'session.create')
     ->label('audits.resource', 'user/{response.userId}')
     ->label('audits.userId', '{response.userId}')
@@ -1594,7 +1594,7 @@ App::post('/v1/account/sessions/token')
     ->desc('Create session')
     ->label('event', 'users.[userId].sessions.[sessionId].create')
     ->groups(['api', 'account'])
-    ->label('scope', 'sessions.write')
+    ->label('scope', 'public')
     ->label('audits.event', 'session.create')
     ->label('audits.resource', 'user/{response.userId}')
     ->label('audits.userId', '{response.userId}')
@@ -1623,7 +1623,7 @@ App::post('/v1/account/tokens/phone')
     ->alias('/v1/account/sessions/phone')
     ->desc('Create phone token')
     ->groups(['api', 'account'])
-    ->label('scope', 'sessions.write')
+    ->label('scope', 'public')
     ->label('auth.type', 'phone')
     ->label('audits.event', 'session.create')
     ->label('audits.resource', 'user/{response.userId}')
@@ -1788,7 +1788,7 @@ App::post('/v1/account/sessions/anonymous')
     ->desc('Create anonymous session')
     ->groups(['api', 'account', 'auth', 'session'])
     ->label('event', 'users.[userId].sessions.[sessionId].create')
-    ->label('scope', 'sessions.write')
+    ->label('scope', 'public')
     ->label('auth.type', 'anonymous')
     ->label('audits.event', 'session.create')
     ->label('audits.resource', 'user/{response.userId}')
@@ -1930,7 +1930,7 @@ App::post('/v1/account/sessions/anonymous')
 App::post('/v1/account/jwt')
     ->desc('Create JWT')
     ->groups(['api', 'account', 'auth'])
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('auth.type', 'jwt')
     ->label('sdk.auth', [])
     ->label('sdk.namespace', 'account')
@@ -1977,7 +1977,7 @@ App::post('/v1/account/jwt')
 App::get('/v1/account')
     ->desc('Get account')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.read')
+    ->label('scope', 'public')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
     ->label('sdk.namespace', 'account')
     ->label('sdk.method', 'get')
@@ -2000,7 +2000,7 @@ App::get('/v1/account')
 App::get('/v1/account/prefs')
     ->desc('Get account preferences')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.read')
+    ->label('scope', 'public')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
     ->label('sdk.namespace', 'account')
     ->label('sdk.method', 'getPrefs')
@@ -2022,7 +2022,7 @@ App::get('/v1/account/prefs')
 App::get('/v1/account/sessions')
     ->desc('List sessions')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.read')
+    ->label('scope', 'public')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
     ->label('sdk.namespace', 'account')
     ->label('sdk.method', 'listSessions')
@@ -2057,7 +2057,7 @@ App::get('/v1/account/sessions')
 App::get('/v1/account/logs')
     ->desc('List logs')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.read')
+    ->label('scope', 'public')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
     ->label('sdk.namespace', 'account')
     ->label('sdk.method', 'listLogs')
@@ -2122,7 +2122,7 @@ App::get('/v1/account/logs')
 App::get('/v1/account/sessions/:sessionId')
     ->desc('Get session')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.read')
+    ->label('scope', 'public')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
     ->label('sdk.namespace', 'account')
     ->label('sdk.method', 'getSession')
@@ -2164,7 +2164,7 @@ App::patch('/v1/account/name')
     ->desc('Update name')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].update.name')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.update')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
@@ -2197,7 +2197,7 @@ App::patch('/v1/account/password')
     ->desc('Update password')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].update.password')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.update')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('audits.userId', '{response.$id}')
@@ -2266,7 +2266,7 @@ App::patch('/v1/account/email')
     ->desc('Update email')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].update.email')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.update')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
@@ -2358,7 +2358,7 @@ App::patch('/v1/account/phone')
     ->desc('Update phone')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].update.phone')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.update')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
@@ -2439,7 +2439,7 @@ App::patch('/v1/account/prefs')
     ->desc('Update preferences')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].update.prefs')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.update')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
@@ -2472,7 +2472,7 @@ App::patch('/v1/account/status')
     ->desc('Update status')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].update.status')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.update')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
@@ -2514,7 +2514,7 @@ App::patch('/v1/account/status')
 App::delete('/v1/account/sessions/:sessionId')
     ->desc('Delete session')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('event', 'users.[userId].sessions.[sessionId].delete')
     ->label('audits.event', 'session.delete')
     ->label('audits.resource', 'user/{user.$id}')
@@ -2594,7 +2594,7 @@ App::delete('/v1/account/sessions/:sessionId')
 App::patch('/v1/account/sessions/:sessionId')
     ->desc('Update (or renew) a session')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('event', 'users.[userId].sessions.[sessionId].update')
     ->label('audits.event', 'session.update')
     ->label('audits.resource', 'user/{response.userId}')
@@ -2670,7 +2670,7 @@ App::patch('/v1/account/sessions/:sessionId')
 App::delete('/v1/account/sessions')
     ->desc('Delete sessions')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('event', 'users.[userId].sessions.[sessionId].delete')
     ->label('audits.event', 'session.delete')
     ->label('audits.resource', 'user/{user.$id}')
@@ -2735,7 +2735,7 @@ App::delete('/v1/account/sessions')
 App::post('/v1/account/recovery')
     ->desc('Create password recovery')
     ->groups(['api', 'account'])
-    ->label('scope', 'sessions.write')
+    ->label('scope', 'public')
     ->label('event', 'users.[userId].recovery.[tokenId].create')
     ->label('audits.event', 'recovery.create')
     ->label('audits.resource', 'user/{response.userId}')
@@ -2912,7 +2912,7 @@ App::post('/v1/account/recovery')
 App::put('/v1/account/recovery')
     ->desc('Create password recovery (confirmation)')
     ->groups(['api', 'account'])
-    ->label('scope', 'sessions.write')
+    ->label('scope', 'public')
     ->label('event', 'users.[userId].recovery.[tokenId].update')
     ->label('audits.event', 'recovery.update')
     ->label('audits.resource', 'user/{response.userId}')
@@ -2997,7 +2997,7 @@ App::put('/v1/account/recovery')
 App::post('/v1/account/verification')
     ->desc('Create email verification')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('event', 'users.[userId].verification.[tokenId].create')
     ->label('audits.event', 'verification.create')
     ->label('audits.resource', 'user/{response.userId}')
@@ -3217,7 +3217,7 @@ App::put('/v1/account/verification')
 App::post('/v1/account/verification/phone')
     ->desc('Create phone verification')
     ->groups(['api', 'account', 'auth'])
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('auth.type', 'phone')
     ->label('event', 'users.[userId].verification.[tokenId].create')
     ->label('audits.event', 'verification.create')
@@ -3388,7 +3388,7 @@ App::patch('/v1/account/mfa')
     ->desc('Update MFA')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].update.mfa')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.update')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('audits.userId', '{response.$id}')
@@ -3421,7 +3421,7 @@ App::patch('/v1/account/mfa')
 App::get('/v1/account/mfa/factors')
     ->desc('List Factors')
     ->groups(['api', 'account', 'mfa'])
-    ->label('scope', 'accounts.read')
+    ->label('scope', 'public')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
     ->label('sdk.namespace', 'account')
     ->label('sdk.method', 'listFactors')
@@ -3448,7 +3448,7 @@ App::post('/v1/account/mfa/:factor')
     ->desc('Add Authenticator')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].update.mfa')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.update')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('audits.userId', '{response.$id}')
@@ -3507,7 +3507,7 @@ App::put('/v1/account/mfa/:factor')
     ->desc('Verify Authenticator')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].update.mfa')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.update')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('audits.userId', '{response.$id}')
@@ -3563,7 +3563,7 @@ App::delete('/v1/account/mfa/:provider')
     ->desc('Delete Authenticator')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].delete.mfa')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.update')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('audits.userId', '{response.$id}')
@@ -3612,7 +3612,7 @@ App::delete('/v1/account/mfa/:provider')
 App::post('/v1/account/mfa/challenge')
     ->desc('Create MFA Challenge')
     ->groups(['api', 'account', 'mfa'])
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('event', 'users.[userId].challenges.[challengeId].create')
     ->label('auth.type', 'createChallenge')
     ->label('audits.event', 'challenge.create')
@@ -3707,7 +3707,7 @@ App::post('/v1/account/mfa/challenge')
 App::put('/v1/account/mfa/challenge')
     ->desc('Create MFA Challenge (confirmation)')
     ->groups(['api', 'account', 'mfa'])
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('event', 'users.[userId].sessions.[tokenId].create')
     ->label('audits.event', 'challenges.update')
     ->label('audits.resource', 'user/{response.userId}')
@@ -3773,7 +3773,7 @@ App::delete('/v1/account')
     ->desc('Delete account')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].delete')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.delete')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN])
diff --git a/tests/e2e/Scopes/ProjectCustom.php b/tests/e2e/Scopes/ProjectCustom.php
index 6d44d535c8..63d5bf5859 100644
--- a/tests/e2e/Scopes/ProjectCustom.php
+++ b/tests/e2e/Scopes/ProjectCustom.php
@@ -60,6 +60,8 @@ trait ProjectCustom
         ], [
             'name' => 'Demo Project Key',
             'scopes' => [
+                'public',
+                'account',
                 'users.read',
                 'users.write',
                 'teams.read',
@@ -83,9 +85,6 @@ trait ProjectCustom
                 'health.read',
                 'rules.read',
                 'rules.write',
-                'sessions.write',
-                'accounts.write',
-                'accounts.read',
                 'targets.read',
                 'targets.write',
                 'providers.read',