fix: Remove fragment from AuthenticationHelper (#12477)

shared/helpers/AuthenticationHelper.test.ts

@@ -21,6 +21,20 @@ describe("AuthenticationHelper", () => {
         expect(canAccess("/api/documents.info?foo=bar", scopes)).toBe(true);
       });
 
+      it("should ignore URL fragment", async () => {
+        const scopes = ["/api/documents.info"];
+
+        expect(
+          canAccess("/api/documents.create#foo/api/documents.info", scopes)
+        ).toBe(false);
+        expect(
+          canAccess("/api/documents.info#foo/api/documents.create", scopes)
+        ).toBe(true);
+        expect(
+          canAccess("/api/documents.create?x=1#foo/api/documents.info", scopes)
+        ).toBe(false);
+      });
+
       it("should return false if no matching scope", async () => {
         const scopes = ["/api/documents.info"];
 

shared/helpers/AuthenticationHelper.ts

@@ -39,8 +39,8 @@ export default class AuthenticationHelper {
       return true;
     }
 
-    // strip any query string, this is never used as part of scope matching
-    path = path.split("?")[0];
+    // strip any query string or fragment, these are never used as part of scope matching
+    path = path.split("?")[0].split("#")[0];
 
     const resource = path.split("/").pop() ?? "";
     const [namespace, method] = resource.split(".");