fix(auth): allow API keys to manage workspace variables and case attachments

[mcm]

Summary

The /variables/* and /cases/{id}/attachments/* routes are declared with WorkspaceUserRouteRole, which sets allow_api_key=False. The auth dispatcher in tracecat/auth/credentials.py:892-907 raises 403 Forbidden when a bearer token comes in as an API key but the route doesn't accept API keys — before any scope check runs. Service accounts can never reach these routes, regardless of granted scopes.

This blocks downstream integrations from:

• writing per-workspace connection variables via API key (the original symptom that surfaced this)
• listing / uploading / downloading / deleting case attachments via API key

The case:read/case:update scopes the attachments router requires were already in WORKSPACE_SERVICE_ACCOUNT_ASSIGNABLE_SCOPES, so attachments was an obvious oversight. The variable:* scopes were absent from the allowlist, so this PR adds them too.

Changes

• tracecat/variables/router.py — swap WorkspaceUserRouteRole → WorkspaceActorRouteRole on all 6 endpoints.
• tracecat/cases/attachments/router.py — swap WorkspaceUserRouteRole → WorkspaceActorRouteRole on all 4 endpoints.
• tracecat/service_accounts/constants.py — add variable:{read,create,update,delete} to WORKSPACE_SERVICE_ACCOUNT_ASSIGNABLE_SCOPES (the org allowlist inherits via union).
• tests/unit/test_service_accounts_validation.py — move variable:* scopes from the "rejects user-only scopes" parametrize lists into the "allows supported API-key scopes" lists for both workspace and org variants.

Compatibility

• User sessions are unaffected — WorkspaceActorRouteRole is a superset of WorkspaceUserRouteRole (both have allow_user=True, this one just also has allow_api_key=True).
• Existing service accounts won't auto-gain the new variable:* scopes; admins need to grant them per service account.
• Workspace membership is still required (unchanged require_workspace="yes").

Test plan

• ruff check clean on touched files
• ruff format --diff clean on touched files
• basedpyright --warnings clean on touched files
• CI unit/registry/temporal test groups (no local docker stack to run them against)
• Manual verification: create + read + update a workspace variable via API key with the new variable:* scopes
• Manual verification: list + upload + download + delete a case attachment via API key

Related

Follows the same pattern as #2755 ("fix: allow API keys to fetch workflow details").

There are a few other WorkspaceUserRouteRole routes whose required scopes are already in the service-account assignable allowlist (cases/rows/router.py, several agent/* routers, three webhook endpoints in workflow/management/router.py, POST /workflow-executions/draft, parts of integrations/router.py). Those weren't flipped here since I have no immediate use case for them — happy to follow up in separate PRs if the team agrees they should also be Actor-role.

---

Summary by cubic

Fixes 403s for API-key requests to workspace variables and case attachments by allowing service accounts on those routes. Integrations can now manage variables and upload/download attachments with API keys.

• Bug Fixes

  • Switched /variables/* and /cases/{id}/attachments/* to WorkspaceActorRouteRole so API keys are accepted.
  • Added variable:{read,create,update,delete} to WORKSPACE_SERVICE_ACCOUNT_ASSIGNABLE_SCOPES and updated tests.

• Migration

  • Grant variable:* scopes to service accounts that need variable access.

^{Written for commit b496fff. Summary will update on new commits. Review in cubic}

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to b496fff.

Security Overview

• 🔎 Scanned files: 4 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/00dffd6c-8834-4dc9-b6d8-b44cd1622986?scanId=da99b69e-7ce5-4a36-b10a-39949d5f2cee&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type

Relevant files

Enhancement

► tests/unit/test_service_accounts_validation.py     Add variable scopes to allowed list for service accounts     Remove variable scopes from disallowed list for service accounts ► tracecat/cases/attachments/router.py     Use WorkspaceActorRouteRole instead of WorkspaceUserRouteRole ► tracecat/service_accounts/constants.py     Add variable read, create, update, and delete scopes ► tracecat/variables/router.py     Use WorkspaceActorRouteRole instead of WorkspaceUserRouteRole

[cubic-dev-ai]

No issues found across 4 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}