fix: Path with query string does not work with scope restrictions, closes #8489

server/models/ApiKey.test.ts

@@ -46,6 +46,15 @@ describe("#ApiKey", () => {
   });
 
   describe("canAccess", () => {
+    it("should account for query string", async () => {
+      const apiKey = await buildApiKey({
+        name: "Dev",
+        scope: ["/api/documents.info"],
+      });
+
+      expect(apiKey.canAccess("/api/documents.info?foo=bar")).toBe(true);
+    });
+
     it("should return true for all resources if no scope", async () => {
       const apiKey = await buildApiKey({
         name: "Dev",

server/models/ApiKey.ts

@@ -174,6 +174,9 @@ class ApiKey extends ParanoidModel<
       return true;
     }
 
+    // strip any query string from the path
+    path = path.split("?")[0];
+
     const resource = path.split("/").pop() ?? "";
     const [namespace, method] = resource.split(".");