Release govoplan-access v0.1.25: harden authentication and repair identity mappings

src/govoplan_access/backend/permissions/catalog.py

@@ -212,11 +212,29 @@ def intersect_api_key_scopes(user_scopes: Iterable[str], key_scopes: Iterable[st
     allowed.update(
         scope
         for scope in user_raw.intersection(key_raw)
-        if not scope.startswith("system:") and scope not in {"*", "tenant:*"}
+        if _is_concrete_tenant_credential_scope(scope, catalog)
     )
     return sorted(allowed)
 
 
+def _is_concrete_tenant_credential_scope(
+    scope: str,
+    catalog: Mapping[str, PermissionDefinition],
+) -> bool:
+    # Wildcards are expanded against the tenant catalogue above. Returning the
+    # wildcard itself could grant system permissions sharing the module prefix,
+    # or permissions outside the currently known tenant catalogue.
+    if scope == "*" or scope.endswith(":*"):
+        return False
+    # System permissions can use module-native names (e.g. access:tenant:create),
+    # so excluding only the historical system: prefix is not sufficient.
+    return all(
+        not alias.startswith("system:")
+        and (alias not in catalog or catalog[alias].level == "tenant")
+        for alias in compatible_required_scopes(scope)
+    )
+
+
 def _active_permission_definitions() -> tuple[PermissionDefinition, ...]:
     registry = _registry()
     if registry is not None and hasattr(registry, "permissions"):