Merge pull request from GHSA-7pxq-6xx9-xpgm

* fix: fix improper authorization when accessing with third-party application

* refactor: refactor type definitions

* fix: get rid of unnecessary access limitation

* enhance: サードパーティアプリケーションがWebsocket APIを使えるように

* fix: add missing parentheses

* Revert "fix(backend): add missing kind definition for admin endpoints to improve security"

This reverts commit 5150053275594278e9eb23e72d98b16593c4c230.

* frontend: 翻訳の抜けを訂正, read:adminとwrite:adminはアクセス発行トークンのデフォルトでは非表示にする

* enhance(test): misskey-ghsa-7pxq-6xx9-xpgmに関するテストを追加

* enhance(test): Websocket APIに対するテストも追加

* enhance(refactor): `@/misc/api-permissions.ts`を`misskey-js/permissions`に統合

* fix(frontend): アクセストークン発行UIで全ての権限を有効にした際、管理者用APIへのアクセスも許可してしまう問題を修正

* enhance(backend): Websocketの接続に最低限必要な権限を変更

* fix(backend): `/api/admin/meta`をサードパーティアプリケーションからはアクセスできないように

* fix(backend): エンドポイントにアクセスするために必要な権限を変更

* fix(frontend/locale): Add missing type declaration

* chore: update `misskey-js/src/autogen`

---------

Co-authored-by: tamaina <tamaina@hotmail.co.jp>

1 files changed, 49 insertions, 1 deletions

diff --git a/packages/misskey-js/src/consts.ts b/packages/misskey-js/src/consts.ts
index e769bb9e6d..0e446c1215 100644
--- a/packages/misskey-js/src/consts.ts
+++ b/packages/misskey-js/src/consts.ts
@@ -45,7 +45,55 @@ export const permissions = [
 	'write:flash',
 	'read:flash-likes',
 	'write:flash-likes',
-];
+	'read:admin:abuse-user-reports',
+	'write:admin:delete-account',
+	'write:admin:delete-all-files-of-a-user',
+	'read:admin:index-stats',
+	'read:admin:table-stats',
+	'read:admin:user-ips',
+	'read:admin:meta',
+	'write:admin:reset-password',
+	'write:admin:resolve-abuse-user-report',
+	'write:admin:send-email',
+	'read:admin:server-info',
+	'read:admin:show-moderation-log',
+	'read:admin:show-user',
+	'read:admin:show-users',
+	'write:admin:suspend-user',
+	'write:admin:unset-user-avatar',
+	'write:admin:unset-user-banner',
+	'write:admin:unsuspend-user',
+	'write:admin:meta',
+	'write:admin:user-note',
+	'write:admin:roles',
+	'read:admin:roles',
+	'write:admin:relays',
+	'read:admin:relays',
+	'write:admin:invite-codes',
+	'read:admin:invite-codes',
+	'write:admin:announcements',
+	'read:admin:announcements',
+	'write:admin:avatar-decorations',
+	'read:admin:avatar-decorations',
+	'write:admin:federation',
+	'write:admin:account',
+	'read:admin:account',
+	'write:admin:emoji',
+	'read:admin:emoji',
+	'write:admin:queue',
+	'read:admin:queue',
+	'write:admin:promo',
+	'write:admin:drive',
+	'read:admin:drive',
+	'write:admin:ad',
+	'read:admin:ad',
+	'write:invite-codes',
+	'read:invite-codes',
+	'write:clip-favorite',
+	'read:clip-favorite',
+	'read:federation',
+	'write:report-abuse',
+] as const;
 
 export const moderationLogTypes = [
 	'updateServerSettings',