[MEDIUM] settings#index exposes registerId and full schemaIds map to any authenticated user

[rubenvdlinde]

Severity: MEDIUM

Location: lib/Controller/SettingsController.php:81-100 + SettingsService::getSettings()

Description:
The settings#index endpoint is correctly gated with #[NoAdminRequired] and a $user === null → 401 guard, so only authenticated users reach it. However, the response body contains registerId, registerSlug, and schemaIds (a slug→numeric-id map). These internal OR IDs allow any logged-in user to enumerate which OR registers exist on the instance and skip slug-to-id resolution entirely when hitting /api/objects/{registerId}/{schemaSlug} directly.

Combined with finding #1 (default-OPEN schema authorization), this endpoint is an enumeration accelerator: a user learns the exact registerId and schemaIds in one GET, then can directly target any object in any schema without needing to discover slugs.

Suggested fix:
Fix finding #1 (OR auth posture) first — once proper schema-level authorization is in place this becomes informational. As a secondary hardening, restrict schemaIds map to admin-only; non-admin consumers only need registerId to drive the SPA read paths.

---

Source: deep team-reviewer pass 2026-05-27

[rubenvdlinde]

Fixed in the quality loop PRs (#63, #64, #65).