fix some lockdown bugs

Author: CodeMeAPixel

CHANGELOG.md

@@ -21,6 +21,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Optional-auth routes (`GET /bots/{id}`, `/servers/{id}`, `/teams/{id}`,
+  `/users/{id}`) rejected valid user sessions that failed the "limited to
+  Bug Hunters" Origin check or belonged to a banned user, with a 403
+  instead of serving the public response. Server-rendered pages send no
+  `Origin`, so every logged-in regular user got "Bot not found" on
+  approved bots. Those sessions are now treated as anonymous on
+  optional-auth routes.
+
 - The `noxss` validator's event-handler check matched any `on<letters>=`
   anywhere in the text, so an ordinary bot invite link
   (`...applications.commands&permissions=...`) made a long description

api/uapi.go

@@ -193,6 +193,10 @@ func Authorize(r uapi.Route, req *http.Request) (uapi.AuthData, uapi.HttpRespons
 
 			if urlutil.DifferentHost(req.Header.Get("Origin"), state.Config.Sites.Frontend) &&
 				!bugHunter && !perms.IsConfigOwner(targetId) {
+				if r.AuthOptional {
+					return uapi.AuthData{}, uapi.HttpResponse{}, true
+				}
+
 				return uapi.AuthData{}, uapi.HttpResponse{
 					Status: http.StatusForbidden,
 					Json:   types.ApiError{Message: "This environment is limited to Bug Hunters."},
@@ -295,6 +299,10 @@ func Authorize(r uapi.Route, req *http.Request) (uapi.AuthData, uapi.HttpRespons
 			}
 
 			if authData.Banned && auth.AllowedScope != "ban_exempt" {
+				if r.AuthOptional {
+					return uapi.AuthData{}, uapi.HttpResponse{}, true
+				}
+
 				return uapi.AuthData{}, uapi.HttpResponse{
 					Status: http.StatusForbidden,
 					Json:   types.ApiError{Message: "You are banned from the list. If you think this is a mistake, please contact support."},