Withdraw an allowance only from the account's own authorizationsfeature/oauth-application-types

CodeQL flagged the withdraw endpoint: the authorization was looked up by
the identifier in the address and then checked against the account. The
endpoint now searches only the signed-in account's authorizations for that
identifier and revokes the tokens by the identifier it found, so another
account's allowance is never loaded. A test withdraws as another account
and gets 404.

1 files changed, 4 insertions, 0 deletions

diff --git a/apps/api-tests/OAuthFlowTests.cs b/apps/api-tests/OAuthFlowTests.cs
index b550e0e..a900e5d 100644
--- a/apps/api-tests/OAuthFlowTests.cs
+++ b/apps/api-tests/OAuthFlowTests.cs
@@ -160,6 +160,10 @@ public sealed class OAuthFlowTests
         HttpResponseMessage foreign = await browser.SendAsync(HttpMethod.Delete,
             $"/api/v1/oauth/allowed/{authorizationId}", origin: "https://attacker.example");
         Assert.Equal(HttpStatusCode.Forbidden, foreign.StatusCode);
+        OAuthTestClient stranger = new(factory);
+        await stranger.RegisterAndSignInAsync("OAuthStranger4", "stranger4@example.com");
+        Assert.Equal(HttpStatusCode.NotFound, (await stranger.SendAsync(HttpMethod.Delete,
+            $"/api/v1/oauth/allowed/{authorizationId}")).StatusCode);
         HttpResponseMessage withdrawn = await browser.SendAsync(HttpMethod.Delete,
             $"/api/v1/oauth/allowed/{authorizationId}");
         Assert.Equal(HttpStatusCode.NoContent, withdrawn.StatusCode);