test(12.1-05): threat test for the Phase 12.1 framework contracts and the first gate stages

- TestPhase121Threats: one subtest per mitigated threat T-12.1-01 to T-12.1-15
- roster fixture: sentinel names and knobs for failing hooks and providers
- scripts/check-phase12.1.sh: fail-closed go test detector, --self-test and --security

modules/cabana/phase121_fixture_test.go

@@ -11,6 +11,7 @@ import (
 	"os"
 	"path/filepath"
 	"sync"
+	"sync/atomic"
 	"testing"
 	"testing/fstest"
 	"time"
@@ -190,11 +191,50 @@ func (s *rosterSpy) takeBulk() []pact.AdminBulkActionInput {
 	return out
 }
 
+// rosterKnobs switch on failures of the controller's providers, which get no
+// record to carry a sentinel name. A nil pointer switches nothing on.
+type rosterKnobs struct {
+	// permissionOptions makes AdminPermissionOptions fail.
+	permissionOptions atomic.Bool
+	// permissionValues makes AdminPermissionValues fail.
+	permissionValues atomic.Bool
+	// relationLocks makes AdminRelationLocks fail.
+	relationLocks atomic.Bool
+	// slowArchive, when set, runs inside the archive bulk action after the
+	// rows were locked (concurrency tests).
+	slowArchive atomic.Pointer[func()]
+}
+
+// The sentinel names below make one hook of the roster controller misbehave
+// for the person who carries the name.
+const (
+	// rosterKeep: FormBeforeDelete refuses with a ForbiddenError.
+	rosterKeep = "Keep"
+	// rosterKeepAfter: FormAfterUpdate and FormAfterDelete refuse after the
+	// row was written or removed.
+	rosterKeepAfter = "KeepAfter"
+	// rosterShort: ListRowStates answers one entry too few.
+	rosterShort = "Short"
+	// rosterStateErr: ListRowStates fails with a plain error.
+	rosterStateErr = "StateErr"
+	// rosterAppliesErr: the activate record action's Applies fails.
+	rosterAppliesErr = "AppliesErr"
+	// rosterCrash: the archive bulk action fails with a plain error.
+	rosterCrash = "Crash"
+	// rosterRunErr: the reinstate record action fails with a plain error
+	// after its write.
+	rosterRunErr = "RunErr"
+	// rosterDenyCreate and rosterDenyAfterCreate: the create hooks refuse.
+	rosterDenyCreate      = "DenyCreate"
+	rosterDenyAfterCreate = "DenyAfterCreate"
+)
+
 // rosterPlugin is the acme.roster fixture plugin. fsys, when set, replaces
 // the fixture tree (boot-error tests).
 type rosterPlugin struct {
-	spy  *rosterSpy
-	fsys fs.FS
+	spy   *rosterSpy
+	knobs *rosterKnobs
+	fsys  fs.FS
 	// db is the handle the controller reads filter choices and locked tags
 	// with outside a transaction.
 	db *gorm.DB
@@ -208,7 +248,7 @@ func (rosterPlugin) Requires() []string           { return nil }
 func (rosterPlugin) Register(*backpack.App) error { return nil }
 func (rosterPlugin) Boot(*backpack.App) error     { return nil }
 func (p rosterPlugin) AdminControllers() []pact.AdminController {
-	return []pact.AdminController{rosterController{spy: p.spy, db: p.db, relations: p.relations}}
+	return []pact.AdminController{rosterController{spy: p.spy, knobs: p.knobs, db: p.db, relations: p.relations}}
 }
 func (rosterPlugin) Permissions() []pact.Permission {
 	return []pact.Permission{{Code: "acme.roster.access", Roles: []string{"developer"}}, {Code: "acme.roster.manage", Roles: []string{"developer"}}}
@@ -235,6 +275,7 @@ func (rosterPlugin) LangFS() fs.FS {
 
 type rosterController struct {
 	spy       *rosterSpy
+	knobs     *rosterKnobs
 	db        *gorm.DB
 	relations func([]cabana.FieldRelationContract) []cabana.FieldRelationContract
 }
@@ -275,6 +316,9 @@ func (c rosterController) handle(ctx context.Context) *gorm.DB {
 // AdminRelationLocks locks the staff tag for an administrator without
 // acme.roster.manage.
 func (c rosterController) AdminRelationLocks(ctx context.Context, field string) (cabana.RelationLock, error) {
+	if c.knobs != nil && c.knobs.relationLocks.Load() {
+		return cabana.RelationLock{}, fmt.Errorf("the lock table said hunter2")
+	}
 	principal, _ := bouncer.User(ctx)
 	if field != "tags" || cabana.Allows(principal, []string{"acme.roster.manage"}) {
 		return cabana.RelationLock{}, nil
@@ -339,8 +383,13 @@ func (c rosterController) ListRowStates(ctx context.Context, db *gorm.DB, record
 		if person.DeletedAt.Valid {
 			out[i] = append(out[i], pact.RowStateDeleted)
 		}
-		if person.Name == "Odd" {
+		switch person.Name {
+		case "Odd":
 			out[i] = append(out[i], pact.RowState("starred"))
+		case rosterShort:
+			return out[:len(out)-1], nil
+		case rosterStateErr:
+			return nil, fmt.Errorf("the state table said hunter2")
 		}
 	}
 	return out, nil
@@ -387,7 +436,10 @@ var rosterPermissionCodes = []cabana.PermissionOption{
 
 // AdminPermissionOptions serves the permission editor's options per
 // administrator.
-func (rosterController) AdminPermissionOptions(ctx context.Context, field string) ([]cabana.PermissionOption, error) {
+func (c rosterController) AdminPermissionOptions(ctx context.Context, field string) ([]cabana.PermissionOption, error) {
+	if c.knobs != nil && c.knobs.permissionOptions.Load() {
+		return nil, fmt.Errorf("the permission table said hunter2")
+	}
 	if field != "permissions" {
 		return nil, fmt.Errorf("unknown permission field %s", field)
 	}
@@ -402,7 +454,10 @@ func (rosterController) AdminPermissionOptions(ctx context.Context, field string
 }
 
 // AdminPermissionValues reads the stored JSON object.
-func (rosterController) AdminPermissionValues(_ context.Context, _ string, record any) (map[string]int, error) {
+func (c rosterController) AdminPermissionValues(_ context.Context, _ string, record any) (map[string]int, error) {
+	if c.knobs != nil && c.knobs.permissionValues.Load() {
+		return nil, fmt.Errorf("the permission column said hunter2")
+	}
 	person := record.(*rosterPerson)
 	out := map[string]int{}
 	if person.Permissions == nil || *person.Permissions == "" {
@@ -466,11 +521,33 @@ func (c rosterController) FormBeforeCreate(ctx context.Context, model any) error
 	model.(*rosterPerson).Tenant = "acme"
 	storePassword(model.(*rosterPerson), values)
 	delete(values, "notify")
+	if model.(*rosterPerson).Name == rosterDenyCreate {
+		return rosterRefused
+	}
 	return nil
 }
 
-func (c rosterController) FormAfterCreate(ctx context.Context, _ any) error {
+func (c rosterController) FormAfterCreate(ctx context.Context, model any) error {
 	c.spy.recordVirtual("after-create", ctx)
+	if model.(*rosterPerson).Name == rosterDenyAfterCreate {
+		return rosterRefused
+	}
+	return nil
+}
+
+// FormAfterUpdate refuses the name KeepAfter after the row was written.
+func (rosterController) FormAfterUpdate(_ context.Context, model any) error {
+	if model.(*rosterPerson).Name == rosterKeepAfter {
+		return rosterRefused
+	}
+	return nil
+}
+
+// FormBeforeDelete refuses the person named Keep.
+func (rosterController) FormBeforeDelete(_ context.Context, model any) error {
+	if model.(*rosterPerson).Name == rosterKeep {
+		return rosterRefused
+	}
 	return nil
 }
 
@@ -501,7 +578,14 @@ func (rosterController) FormAfterDelete(ctx context.Context, model any) error {
 	if !ok {
 		return fmt.Errorf("no transaction on the context")
 	}
-	return tx.Unscoped().Delete(model).Error
+	if err := tx.Unscoped().Delete(model).Error; err != nil {
+		return err
+	}
+	// Refused after the row was removed: the transaction must bring it back.
+	if model.(*rosterPerson).Name == rosterKeepAfter {
+		return rosterRefused
+	}
+	return nil
 }
 
 // AdminBulkActions: activate needs acme.roster.manage and sets active on the
@@ -540,12 +624,20 @@ func (c rosterController) AdminBulkActions() []pact.AdminBulkAction {
 			if !ok {
 				return pact.AdminBulkActionResult{}, fmt.Errorf("no transaction on the context")
 			}
+			if c.knobs != nil {
+				if wait := c.knobs.slowArchive.Load(); wait != nil {
+					(*wait)()
+				}
+			}
 			for _, record := range in.Records {
 				// A refusal after earlier rows were written: the whole
 				// selection must roll back.
 				if record.(*rosterPerson).Name == rosterLocked {
 					return pact.AdminBulkActionResult{}, rosterRefused
 				}
+				if record.(*rosterPerson).Name == rosterCrash {
+					return pact.AdminBulkActionResult{}, fmt.Errorf("the archive said hunter2")
+				}
 				if err := tx.Delete(record).Error; err != nil {
 					return pact.AdminBulkActionResult{}, err
 				}
@@ -563,6 +655,9 @@ func (c rosterController) AdminRecordActions() []pact.AdminRecordAction {
 		Name: "activate", Label: "acme.roster::lang.people.activate",
 		Permissions: []string{"acme.roster.manage"},
 		Applies: func(_ context.Context, record any) (bool, error) {
+			if record.(*rosterPerson).Name == rosterAppliesErr {
+				return false, fmt.Errorf("the applies check said hunter2")
+			}
 			return !record.(*rosterPerson).Active, nil
 		},
 		Run: func(ctx context.Context, in pact.AdminRecordActionInput) (pact.AdminRecordActionResult, error) {
@@ -594,6 +689,9 @@ func (c rosterController) AdminRecordActions() []pact.AdminRecordAction {
 			if in.Record.(*rosterPerson).Name == rosterLocked {
 				return pact.AdminRecordActionResult{}, rosterRefused
 			}
+			if in.Record.(*rosterPerson).Name == rosterRunErr {
+				return pact.AdminRecordActionResult{}, fmt.Errorf("the reinstate said hunter2")
+			}
 			return pact.AdminRecordActionResult{}, nil
 		},
 	}}
@@ -604,7 +702,8 @@ func (c rosterController) AdminRecordActions() []pact.AdminRecordAction {
 // token), limited (acme.roster.access only), cookie and cookie-only.
 type rosterEnv struct {
 	*actEnv
-	spy *rosterSpy
+	spy   *rosterSpy
+	knobs *rosterKnobs
 }
 
 func newRosterEnv(t *testing.T) (*rosterEnv, *gorm.DB) {
@@ -656,7 +755,8 @@ func newRosterEnvWith(t *testing.T, configure func(*rosterPlugin)) (*rosterEnv,
 		t.Fatal(err)
 	}
 	spy := &rosterSpy{}
-	plugin := rosterPlugin{spy: spy, db: gdb}
+	knobs := &rosterKnobs{}
+	plugin := rosterPlugin{spy: spy, knobs: knobs, db: gdb}
 	if configure != nil {
 		configure(&plugin)
 	}
@@ -668,7 +768,7 @@ func newRosterEnvWith(t *testing.T, configure func(*rosterPlugin)) (*rosterEnv,
 	if err != nil {
 		t.Fatal(err)
 	}
-	env := &rosterEnv{actEnv: &actEnv{h: h}, spy: spy}
+	env := &rosterEnv{actEnv: &actEnv{h: h}, spy: spy, knobs: knobs}
 	rec := postJSON(t, h, adminAPI("/auth/login"), map[string]string{"login": login, "password": adminTestPassword})
 	if rec.Code != http.StatusOK {
 		t.Fatalf("login status=%d body=%s", rec.Code, rec.Body.String())

modules/cabana/phase121_threats_test.go

@@ -0,0 +1,447 @@
+package cabana_test
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"reflect"
+	"strings"
+	"sync"
+	"testing"
+
+	"git.golem15.com/golem15/summercms/modules/cabana"
+)
+
+// rosterIDs is the body of a bulk request.
+func rosterIDs(ids ...uint) string {
+	raw, _ := json.Marshal(map[string]any{"ids": ids})
+	return string(raw)
+}
+
+// rosterPath is the admin path of one person, with an optional suffix.
+func rosterPath(id uint, suffix string) string {
+	return fmt.Sprintf("%s/%d%s", rosterPeople, id, suffix)
+}
+
+// rosterPair is the password pair every roster create needs.
+const rosterPair = `"password":"long-enough-1","password_confirmation":"long-enough-1"`
+
+// logCapture keeps the records written to the default logger while it is
+// installed.
+type logCapture struct {
+	mu      sync.Mutex
+	records []string
+}
+
+func (c *logCapture) Enabled(context.Context, slog.Level) bool { return true }
+func (c *logCapture) WithAttrs([]slog.Attr) slog.Handler       { return c }
+func (c *logCapture) WithGroup(string) slog.Handler            { return c }
+func (c *logCapture) Handle(_ context.Context, record slog.Record) error {
+	var line strings.Builder
+	line.WriteString(record.Message)
+	record.Attrs(func(attr slog.Attr) bool {
+		fmt.Fprintf(&line, " %s=%v", attr.Key, attr.Value.Any())
+		return true
+	})
+	c.mu.Lock()
+	c.records = append(c.records, line.String())
+	c.mu.Unlock()
+	return nil
+}
+
+// matching returns the captured lines that start with prefix.
+func (c *logCapture) matching(prefix string) []string {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	var out []string
+	for _, line := range c.records {
+		if strings.HasPrefix(line, prefix) {
+			out = append(out, line)
+		}
+	}
+	return out
+}
+
+// captureLog installs a capturing default logger for the rest of the test.
+func captureLog(t *testing.T) *logCapture {
+	t.Helper()
+	capture := &logCapture{}
+	previous := slog.Default()
+	slog.SetDefault(slog.New(capture))
+	t.Cleanup(func() { slog.SetDefault(previous) })
+	return capture
+}
+
+// TestPhase121Threats has one subtest per mitigated framework threat of
+// Phase 12.1, named by its id. Each asserts the protection through the admin
+// API on the acme.roster fixture, so removing the protection fails the
+// subtest on an assertion (scripts/check-phase12.1.sh --removal).
+//
+// T-12.1-16 (a preview URL in plugin YAML that points at a foreign route) is
+// mitigated in the SPA and pinned by the vitest case "backstop: mapWinterUrl
+// maps preview/:id to the preview route" in admin/tests/app/winterUrl.test.ts.
+// T-12.1-17 (the tag) is a release step and has no code path.
+func TestPhase121Threats(t *testing.T) {
+	t.Run("T-12.1-01", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		own := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Own"})
+		foreign := rosterInsert(t, gdb, rosterPerson{Tenant: "other", Name: "Foreign"})
+		// Only out-of-scope ids: nothing reaches Run and nothing changes.
+		rec := env.expect(t, http.StatusOK, http.MethodPost, rosterPeople+"/bulk/activate", rosterIDs(foreign), "bearer")
+		if result := rosterBulkResult(t, rec); result.Affected != 0 {
+			t.Fatalf("out-of-scope selection affected %d rows", result.Affected)
+		}
+		// A mixed selection is refused as a whole.
+		rec = env.expect(t, http.StatusConflict, http.MethodPost, rosterPeople+"/bulk/activate", rosterIDs(own, foreign), "bearer")
+		actErrorCode(t, rec.Body.Bytes(), "conflict")
+		if calls := env.spy.takeBulk(); len(calls) != 0 {
+			t.Fatalf("Run was called with %d selections for ids outside the list scope", len(calls))
+		}
+		if rosterLoad(t, gdb, own).Active || rosterLoad(t, gdb, foreign).Active {
+			t.Fatal("a refused selection changed a row")
+		}
+	})
+
+	t.Run("T-12.1-02", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		idle := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Idle"})
+		// Undeclared names, and names registered in the other namespace only.
+		for _, name := range []string{"missing", "reinstate", "delete", "create"} {
+			env.expect(t, http.StatusNotFound, http.MethodPost, rosterPeople+"/bulk/"+name, rosterIDs(idle), "bearer")
+		}
+		for _, name := range []string{"missing", "archive", "delete", "create"} {
+			env.expect(t, http.StatusNotFound, http.MethodPost, rosterPath(idle, "/actions/"+name), `{}`, "bearer")
+		}
+		// Declared, but the administrator lacks the action's own permission.
+		rec := env.expect(t, http.StatusForbidden, http.MethodPost, rosterPeople+"/bulk/activate", rosterIDs(idle), "limited")
+		actErrorCode(t, rec.Body.Bytes(), "forbidden")
+		rec = env.expect(t, http.StatusForbidden, http.MethodPost, rosterPath(idle, "/actions/activate"), `{}`, "limited")
+		actErrorCode(t, rec.Body.Bytes(), "forbidden")
+		if rosterLoad(t, gdb, idle).Active {
+			t.Fatal("an action ran without its permission")
+		}
+		if calls, one := env.spy.takeBulk(), env.spy.takeRecord(); len(calls) != 0 || len(one) != 0 {
+			t.Fatalf("a refused action reached the plugin: bulk=%d record=%d", len(calls), len(one))
+		}
+		// The same action is absent from what that administrator is offered.
+		if got := rosterBulkNames(t, env, "limited"); !reflect.DeepEqual(got, []string{"delete", "archive"}) {
+			t.Fatalf("limited admin is offered bulk actions %v", got)
+		}
+		if got := rosterOffered(t, env, idle, "limited"); len(got) != 0 {
+			t.Fatalf("limited admin is offered record actions %v", got)
+		}
+		if got := rosterOffered(t, env, idle, "bearer"); !reflect.DeepEqual(got, []string{"activate"}) {
+			t.Fatalf("full admin is offered record actions %v", got)
+		}
+	})
+
+	t.Run("T-12.1-03", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		idle := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Idle"})
+		for _, rel := range []string{rosterPeople + "/bulk/activate", rosterPath(idle, "/actions/activate")} {
+			body := `{}`
+			if strings.Contains(rel, "/bulk/") {
+				body = rosterIDs(idle)
+			}
+			rec := env.expect(t, http.StatusForbidden, http.MethodPost, rel, body, "cookie-only")
+			actErrorCode(t, rec.Body.Bytes(), "forbidden")
+			if rosterLoad(t, gdb, idle).Active {
+				t.Fatalf("%s ran for a cookie request without X-Requested-With", rel)
+			}
+		}
+		// The same cookie with the header is accepted.
+		env.expect(t, http.StatusOK, http.MethodPost, rosterPath(idle, "/actions/activate"), `{}`, "cookie")
+		if !rosterLoad(t, gdb, idle).Active {
+			t.Fatal("the cookie request with the header did not run")
+		}
+	})
+
+	t.Run("T-12.1-04", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		active := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Active", Active: true})
+		foreign := rosterInsert(t, gdb, rosterPerson{Tenant: "other", Name: "Foreign"})
+		rec := env.expect(t, http.StatusNotFound, http.MethodPost, rosterPath(foreign, "/actions/activate"), `{}`, "bearer")
+		actErrorCode(t, rec.Body.Bytes(), "not_found")
+		rec = env.expect(t, http.StatusConflict, http.MethodPost, rosterPath(active, "/actions/activate"), `{}`, "bearer")
+		actErrorCode(t, rec.Body.Bytes(), "conflict")
+		if calls := env.spy.takeRecord(); len(calls) != 0 {
+			t.Fatalf("Run was called %d times for a record outside the scope or state", len(calls))
+		}
+		if rosterLoad(t, gdb, foreign).Active {
+			t.Fatal("an out-of-scope record was changed")
+		}
+	})
+
+	t.Run("T-12.1-05", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		first := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "First"})
+		second := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Second"})
+		crash := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: rosterCrash})
+		// The action soft-deletes the first two rows and fails on the last.
+		env.expect(t, http.StatusInternalServerError, http.MethodPost, rosterPeople+"/bulk/archive", rosterIDs(first, second, crash), "bearer")
+		for _, id := range []uint{first, second, crash} {
+			if rosterLoad(t, gdb, id).DeletedAt.Valid {
+				t.Fatalf("row %d kept the write of a bulk action that failed on the last row", id)
+			}
+		}
+		if calls := env.spy.takeBulk(); len(calls) != 1 || len(calls[0].Records) != 3 {
+			t.Fatalf("the action did not run over the three rows: %+v", calls)
+		}
+	})
+
+	t.Run("T-12.1-06", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Ada"})
+		rec := env.expect(t, http.StatusInternalServerError, http.MethodPut, rosterPath(id, ""), `{"name":"Boom"}`, "bearer")
+		if got := rosterError(t, rec); got.Code != "error" || len(got.Details) != 0 {
+			t.Fatalf("500 error = %+v", got)
+		}
+		for _, leak := range []string{"hunter2", "roster database"} {
+			if strings.Contains(rec.Body.String(), leak) {
+				t.Fatalf("the 500 body carries the hook's error text %q: %s", leak, rec.Body.String())
+			}
+		}
+		crash := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: rosterCrash})
+		rec = env.expect(t, http.StatusInternalServerError, http.MethodPost, rosterPeople+"/bulk/archive", rosterIDs(crash), "bearer")
+		if strings.Contains(rec.Body.String(), "hunter2") {
+			t.Fatalf("the 500 body of a bulk action carries its error text: %s", rec.Body.String())
+		}
+		// A ForbiddenError is the one error whose text is the plugin's to show.
+		rec = env.expect(t, http.StatusForbidden, http.MethodPut, rosterPath(id, ""), `{"name":"Reserved"}`, "bearer")
+		if got := rosterError(t, rec); got.Code != "forbidden" || got.Message != "You may not rename this person." {
+			t.Fatalf("403 error = %+v", got)
+		}
+	})
+
+	t.Run("T-12.1-07", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		odd := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Odd", Active: true})
+		idle := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Idle"})
+		body, raw := rosterList(t, env, "")
+		if strings.Contains(raw, "starred") {
+			t.Fatalf("a row state outside the fixed set was sent: %s", raw)
+		}
+		if _, ok := body.Meta.RowStates[fmt.Sprint(odd)]; ok {
+			t.Fatalf("a row with only an unknown state is listed: %v", body.Meta.RowStates)
+		}
+		if got := body.Meta.RowStates[fmt.Sprint(idle)]; !reflect.DeepEqual(got, []string{"disabled"}) {
+			t.Fatalf("known state = %v", got)
+		}
+	})
+
+	t.Run("T-12.1-08", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		idle := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Secretname", Email: "secret@example.test"})
+		logs := captureLog(t)
+		env.expect(t, http.StatusOK, http.MethodPost, rosterPeople+"/bulk/activate", rosterIDs(idle), "bearer")
+		banned := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Secretname", Email: "secret@example.test", Active: true, Banned: true})
+		env.expect(t, http.StatusOK, http.MethodPost, rosterPath(banned, "/actions/reinstate"), `{}`, "bearer")
+
+		bulk := logs.matching("cabana: admin bulk action")
+		if len(bulk) != 1 || !strings.Contains(bulk[0], "controller=acme.roster.people") || !strings.Contains(bulk[0], "action=activate") || !strings.Contains(bulk[0], "affected=1") {
+			t.Fatalf("bulk action log lines = %q", bulk)
+		}
+		record := logs.matching("cabana: admin record action")
+		if len(record) != 1 || !strings.Contains(record[0], "action=reinstate") || !strings.Contains(record[0], fmt.Sprintf("record_id=%d", banned)) {
+			t.Fatalf("record action log lines = %q", record)
+		}
+		for _, line := range append(bulk, record...) {
+			if !strings.Contains(line, "admin_id=") || strings.Contains(line, "admin_id=0") {
+				t.Fatalf("log line lacks the admin id: %q", line)
+			}
+			if strings.Contains(line, "Secretname") || strings.Contains(line, "secret@example.test") {
+				t.Fatalf("log line carries record contents: %q", line)
+			}
+		}
+		// A refused request writes no action line.
+		env.expect(t, http.StatusForbidden, http.MethodPost, rosterPeople+"/bulk/activate", rosterIDs(idle), "limited")
+		if got := logs.matching("cabana: admin bulk action"); len(got) != 1 {
+			t.Fatalf("a refused action was logged as run: %q", got)
+		}
+	})
+
+	t.Run("T-12.1-09", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		rec := env.expect(t, http.StatusCreated, http.MethodPost, rosterPeople, `{"name":"Vic","notify":true,`+rosterPair+`}`, "bearer")
+		for _, name := range []string{"notify", "password"} {
+			if strings.Contains(rec.Body.String(), name) {
+				t.Fatalf("the create response carries the virtual field %s: %s", name, rec.Body.String())
+			}
+		}
+		created, _ := rosterRecord(t, rec.Body.Bytes()).Data["id"].(float64)
+		stored := rosterLoad(t, gdb, uint(created))
+		// The password column holds only what the hook derived; the submitted
+		// text never reached it through Fill.
+		if stored.Password != rosterHash("long-enough-1") {
+			t.Fatalf("a virtual value was bound to the model: password column = %q", stored.Password)
+		}
+		rec = env.expect(t, http.StatusOK, http.MethodGet, rosterPath(uint(created), ""), "", "bearer")
+		if strings.Contains(rec.Body.String(), "notify") || strings.Contains(rec.Body.String(), "password") {
+			t.Fatalf("the show response carries a virtual field: %s", rec.Body.String())
+		}
+	})
+
+	t.Run("T-12.1-10", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		const plain = "s3cret-plain-text"
+		responses := map[string]string{}
+		rec := env.expect(t, http.StatusCreated, http.MethodPost, rosterPeople, fmt.Sprintf(`{"name":"Pat","password":%q,"password_confirmation":%q}`, plain, plain), "bearer")
+		responses["create"] = rec.Body.String()
+		created, _ := rosterRecord(t, rec.Body.Bytes()).Data["id"].(float64)
+		id := uint(created)
+		if rosterLoad(t, gdb, id).Password != rosterHash(plain) {
+			t.Fatal("the password did not reach the hook")
+		}
+		responses["show"] = env.expect(t, http.StatusOK, http.MethodGet, rosterPath(id, ""), "", "bearer").Body.String()
+		responses["list"] = env.expect(t, http.StatusOK, http.MethodGet, rosterPeople, "", "bearer").Body.String()
+		responses["update"] = env.expect(t, http.StatusOK, http.MethodPut, rosterPath(id, ""), fmt.Sprintf(`{"name":"Pat B","password":%q,"password_confirmation":%q}`, plain, plain), "bearer").Body.String()
+		responses["mismatch"] = env.expect(t, http.StatusUnprocessableEntity, http.MethodPut, rosterPath(id, ""), fmt.Sprintf(`{"password":%q,"password_confirmation":"other-enough-1"}`, plain), "bearer").Body.String()
+		for route, body := range responses {
+			if strings.Contains(body, plain) || strings.Contains(body, "sha256:") {
+				t.Fatalf("the %s response carries the password or its hash: %s", route, body)
+			}
+			if route != "mismatch" && strings.Contains(body, `"password`) {
+				t.Fatalf("the %s response carries a password key: %s", route, body)
+			}
+		}
+	})
+
+	t.Run("T-12.1-11", func(t *testing.T) {
+		// The same contract without WritableForeignKey: the field is read-only
+		// and a submitted id is not written.
+		env, gdb := newRosterEnvWith(t, func(p *rosterPlugin) {
+			p.relations = func(in []cabana.FieldRelationContract) []cabana.FieldRelationContract {
+				in[0].WritableForeignKey = false
+				return in
+			}
+		})
+		team := rosterTeam{Tenant: "acme", Name: "Home"}
+		rosterSeed(t, gdb, &team)
+		person := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Ro", Active: true})
+		_, raw := rosterFormSchema(t, env, "bearer")
+		if !strings.Contains(raw, `"name":"team","type":"relation","label":"Team","nameFrom":"name","emptyOption":"No team","readOnly":true}`) {
+			t.Fatalf("the team field is writable without the opt-in: %s", raw)
+		}
+		env.expect(t, http.StatusOK, http.MethodPut, rosterPath(person, ""), fmt.Sprintf(`{"team":%d,"organisation_id":%d}`, team.ID, team.ID), "bearer")
+		if stored := rosterLoad(t, gdb, person); stored.OrganisationID != nil {
+			t.Fatalf("a protected foreign key was written without the opt-in: %d", *stored.OrganisationID)
+		}
+	})
+
+	t.Run("T-12.1-12", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		staff, news := rosterTag{Name: "staff"}, rosterTag{Name: "news"}
+		rosterSeed(t, gdb, &staff)
+		rosterSeed(t, gdb, &news)
+		plain := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Plain", Active: true})
+		member := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Member", Active: true})
+		rosterSeed(t, gdb, &rosterPersonTag{PersonID: plain, TagID: news.ID})
+		rosterSeed(t, gdb, &rosterPersonTag{PersonID: member, TagID: staff.ID})
+		refused := func(method, rel, body string) {
+			t.Helper()
+			rec := env.expect(t, http.StatusForbidden, method, rel, body, "limited")
+			rosterErrorDetail(t, rec.Body.Bytes(), "forbidden", "tags", "You need an additional permission to change the staff tag.")
+		}
+		// Added on update, removed on update, added on create.
+		refused(http.MethodPut, rosterPath(plain, ""), fmt.Sprintf(`{"name":"Sneaky","tags":[%d,%d]}`, news.ID, staff.ID))
+		refused(http.MethodPut, rosterPath(member, ""), `{"tags":[]}`)
+		refused(http.MethodPost, rosterPeople, fmt.Sprintf(`{"name":"Smuggled",%s,"tags":[%d]}`, rosterPair, staff.ID))
+		if got := rosterPivot(t, gdb, plain); !reflect.DeepEqual(got, []uint{news.ID}) {
+			t.Fatalf("a refused save changed the pivot of the plain person: %v", got)
+		}
+		if got := rosterPivot(t, gdb, member); !reflect.DeepEqual(got, []uint{staff.ID}) {
+			t.Fatalf("a refused save changed the pivot of the member: %v", got)
+		}
+		if rosterLoad(t, gdb, plain).Name != "Plain" {
+			t.Fatal("a refused save wrote another field of the same body")
+		}
+		var smuggled int64
+		if err := gdb.Unscoped().Model(&rosterPerson{}).Where("name = ?", "Smuggled").Count(&smuggled).Error; err != nil || smuggled != 0 {
+			t.Fatalf("a refused create left %d rows (%v)", smuggled, err)
+		}
+	})
+
+	t.Run("T-12.1-13", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		stored := `{"reports.export":1}`
+		id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Perm", Active: true, Permissions: &stored})
+		rec := env.expect(t, http.StatusUnprocessableEntity, http.MethodPut, rosterPath(id, ""), `{"permissions":{"admin.root":1,"reports.export":1}}`, "bearer")
+		rosterErrorDetail(t, rec.Body.Bytes(), "validation_failed", "permissions", "The permissions field contains an unknown permission.")
+		rec = env.expect(t, http.StatusUnprocessableEntity, http.MethodPut, rosterPath(id, ""), `{"permissions":{"posts.edit":2,"reports.export":1}}`, "bearer")
+		rosterErrorDetail(t, rec.Body.Bytes(), "validation_failed", "permissions", "The permissions field contains an invalid value.")
+		// The limited admin may not change the locked code, in either direction.
+		for _, body := range []string{`{"permissions":{"posts.edit":1}}`, `{"permissions":{"reports.export":-1}}`} {
+			rec = env.expect(t, http.StatusForbidden, http.MethodPut, rosterPath(id, ""), body, "limited")
+			rosterErrorDetail(t, rec.Body.Bytes(), "forbidden", "permissions", "You cannot change this permission.")
+		}
+		if got := rosterLoad(t, gdb, id).Permissions; got == nil || *got != stored {
+			t.Fatalf("a refused save changed the stored permissions: %v", got)
+		}
+	})
+
+	t.Run("T-12.1-14", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		ip := "203.0.113.7"
+		id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Ada", Active: true, JoinedIP: &ip})
+		env.expect(t, http.StatusOK, http.MethodPut, rosterPath(id, ""), `{"name":"Ada L","joined_ip":"198.51.100.1"}`, "bearer")
+		if got := rosterLoad(t, gdb, id); got.JoinedIP == nil || *got.JoinedIP != ip || got.Name != "Ada L" {
+			t.Fatalf("an update wrote the preview-only field: %+v", got.JoinedIP)
+		}
+		rec := env.expect(t, http.StatusCreated, http.MethodPost, rosterPeople, `{"name":"New","joined_ip":"198.51.100.2",`+rosterPair+`}`, "bearer")
+		created, _ := rosterRecord(t, rec.Body.Bytes()).Data["id"].(float64)
+		if got := rosterLoad(t, gdb, uint(created)); got.JoinedIP != nil {
+			t.Fatalf("a create wrote the preview-only field: %q", *got.JoinedIP)
+		}
+	})
+
+	t.Run("T-12.1-15", func(t *testing.T) {
+		// A status partial that carries active markup next to its callout.
+		const hostile = `<div class="summer-callout" onclick="alert(1)" style="color:red" data-tone="{{ .Data.Tone }}">` +
+			`<script>alert(1)</script><iframe src="/x"></iframe>` +
+			`<a href="javascript:alert(1)" title="t" onmouseover="x">{{ trans .Data.Title }}</a>` +
+			`<img src="//evil.example.test/x.png" onerror="alert(1)" alt="a">` +
+			`<custom-tag>kept text</custom-tag></div>`
+		env, gdb := newRosterEnvWith(t, func(p *rosterPlugin) {
+			p.fsys = rosterTree(t, map[string]string{"controllers/people/_status.htm": hostile})
+		})
+		banned := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Bea", Active: true, Banned: true})
+		rec := env.expect(t, http.StatusOK, http.MethodGet, fmt.Sprintf("%s/partials/status?id=%d", rosterPeople, banned), "", "bearer")
+		var view cabana.Envelope[cabana.PartialView]
+		if err := json.Unmarshal(rec.Body.Bytes(), &view); err != nil {
+			t.Fatalf("partial body %s: %v", rec.Body.String(), err)
+		}
+		if len(view.Data.Nodes) != 1 || view.Data.Nodes[0].Tag != "div" {
+			t.Fatalf("nodes = %+v", view.Data.Nodes)
+		}
+		root := view.Data.Nodes[0]
+		if !reflect.DeepEqual(root.Attrs, map[string]string{"class": "summer-callout", "data-tone": "danger"}) {
+			t.Fatalf("root attributes = %v, want only the allowlisted class and data-tone", root.Attrs)
+		}
+		var tags []string
+		for _, child := range root.Children {
+			tags = append(tags, child.Tag)
+			switch child.Tag {
+			case "a":
+				if !reflect.DeepEqual(child.Attrs, map[string]string{"title": "t"}) {
+					t.Fatalf("link attributes = %v, want no href and no handler", child.Attrs)
+				}
+			case "img":
+				if !reflect.DeepEqual(child.Attrs, map[string]string{"alt": "a"}) {
+					t.Fatalf("image attributes = %v, want no foreign src and no handler", child.Attrs)
+				}
+			}
+		}
+		// script and iframe are dropped with their content; the unknown element
+		// is unwrapped to its text.
+		if !reflect.DeepEqual(tags, []string{"a", "img", ""}) {
+			t.Fatalf("child tags = %q", tags)
+		}
+		for _, banned := range []string{"script", "iframe", "alert(1)", "onclick", "onerror", "onmouseover", "javascript:", "evil.example.test", "style", "custom-tag"} {
+			if strings.Contains(rec.Body.String(), banned) {
+				t.Fatalf("the partial response carries %q: %s", banned, rec.Body.String())
+			}
+		}
+	})
+}