From cfebbacc3d85e7c207107efe2a289629e12ccb8d Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Thu, 22 Oct 2026 12:45:01 +0200 Subject: [PATCH] docs(19.6.1): verification report, gaps found (22/25) --- .../19.6.1-VERIFICATION.md | 301 ++++++++++++++++++ 1 file changed, 301 insertions(+) create mode 100644 .planning/phases/19.6.1-backend-administrators-screen/19.6.1-VERIFICATION.md diff --git a/.planning/phases/19.6.1-backend-administrators-screen/19.6.1-VERIFICATION.md b/.planning/phases/19.6.1-backend-administrators-screen/19.6.1-VERIFICATION.md new file mode 100644 index 00000000..1c9b4ffe --- /dev/null +++ b/.planning/phases/19.6.1-backend-administrators-screen/19.6.1-VERIFICATION.md @@ -0,0 +1,301 @@ +--- +phase: 19.6.1-backend-administrators-screen +verified: 2026-10-22T10:55:00Z +status: gaps_found +score: 22/25 must-haves verified +covered_files: + - .planning/phases/19.6.1-backend-administrators-screen/19.6.1-01-PLAN.md + - .planning/phases/19.6.1-backend-administrators-screen/19.6.1-01-SUMMARY.md + - .planning/phases/19.6.1-backend-administrators-screen/19.6.1-02-PLAN.md + - .planning/phases/19.6.1-backend-administrators-screen/19.6.1-02-SUMMARY.md + - .planning/phases/19.6.1-backend-administrators-screen/19.6.1-03-PLAN.md + - .planning/phases/19.6.1-backend-administrators-screen/19.6.1-03-SUMMARY.md + - admin/openapi/admin.json + - admin/src/api/schema.d.ts + - admin/src/api/types.ts + - admin/src/components/form/FormField.vue + - admin/src/components/form/control.ts + - admin/src/components/form/fields/PermissionEditorField.vue + - admin/src/components/form/formContext.ts + - admin/src/components/form/formState.ts + - admin/src/components/form/trigger.ts + - admin/src/components/relation/RelationChildModal.vue + - admin/src/views/FormView.vue + - admin/src/views/PreviewView.vue + - admin/tests/browser/record-actions-wrap.test.ts + - admin/tests/form/FormView.test.ts + - admin/tests/form/PermissionEditorField.test.ts + - admin/tests/form/PreviewView.test.ts + - admin/tests/form/formState.test.ts + - admin/tests/form/trigger.test.ts + - admin/vitest.browser.config.ts + - docs/backend/admin-controllers.md + - docs/backend/forms.md + - docs/backend/users-and-permissions.md + - modules/cabana/README.md + - modules/cabana/action_extensions.go + - modules/cabana/action_extensions_postgres_test.go + - modules/cabana/action_extensions_test.go + - modules/cabana/admin_openapi.go + - modules/cabana/administrators_harness_test.go + - modules/cabana/administrators_lifecycle_postgres_test.go + - modules/cabana/administrators_postgres_test.go + - modules/cabana/backend_privileges.go + - modules/cabana/backend_privileges_internal_test.go + - modules/cabana/backend_roles_admin.go + - modules/cabana/backend_screens.go + - modules/cabana/backend_screens_smoke_test.go + - modules/cabana/backend_screens_test.go + - modules/cabana/backend_users_admin.go + - modules/cabana/backendscreens/controllers/roles/config_form.yaml + - modules/cabana/backendscreens/controllers/roles/config_list.yaml + - modules/cabana/backendscreens/controllers/users/_hint.htm + - modules/cabana/backendscreens/controllers/users/config_filter.yaml + - modules/cabana/backendscreens/controllers/users/config_form.yaml + - modules/cabana/backendscreens/controllers/users/config_list.yaml + - modules/cabana/backendscreens/models/user/columns.yaml + - modules/cabana/backendscreens/models/user/fields.yaml + - modules/cabana/backendscreens/models/userrole/columns.yaml + - modules/cabana/backendscreens/models/userrole/fields.yaml + - modules/cabana/contracts.go + - modules/cabana/crud.go + - modules/cabana/example_action_extension_test.go + - modules/cabana/example_permission_record_locks_test.go + - modules/cabana/export_test.go + - modules/cabana/field_dependent.go + - modules/cabana/field_permission.go + - modules/cabana/field_repeater.go + - modules/cabana/field_trigger.go + - modules/cabana/field_trigger_smoke_test.go + - modules/cabana/field_trigger_test.go + - modules/cabana/form_schema.go + - modules/cabana/http.go + - modules/cabana/record_locks_smoke_test.go + - modules/cabana/record_locks_test.go + - modules/cabana/registry.go + - modules/cabana/relation_child.go + - modules/cabana/relation_field.go + - modules/cabana/roles_postgres_test.go + - modules/cabana/schema_types.go + - modules/pact/README.md + - modules/pact/capabilities.go + - modules/phrasebook/backend/lang/en/lang.yaml + - modules/phrasebook/backend/lang/pl/lang.yaml + - scripts/check-phase19.6.1.sh +covered_digest: "v2:sha256:ce2ffee04211fae3f2b7542d45027b90d65bf4327d8f280ad470e804da6c4700" +behavior_unverified: 0 +overrides_applied: 0 +gaps: + - truth: "SC-2 / D-07: an admin cannot raise their own role or permissions, and a non-superuser cannot add a permission they lack to any role (Roles screen ceiling)" + status: failed + reason: "Code-declared grants (pact.Permission.Roles) attach to a role by its code string, and code is fillable on the Roles screen. rolesAdmin.FormBeforeCreate only checks code uniqueness; FormBeforeUpdate only refuses a code change when the STORED role is a system role. Neither checks the NEW code against reg.rolePermissions(newCode) nor against the editor's grants. A non-superuser holding only backend.manage_roles renamed their own role onto a code a plugin declares grants for: PUT answered 200, the response's meta.permissionLocks now lists the plugin grant as granted to the role, and FindByID (auth.go:55) merges it into every holder's grants on the next request, the editor included. The role also becomes a system role (code now locked), so the editor's change cannot be undone through the screen. Precondition: a code-declared role code with no row (nothing at boot validates that pact.Permission.Roles codes match backend_user_roles rows; the developer/publisher seed is ON CONFLICT (name) DO NOTHING). Confirmed CR-01 from 19.6.1-REVIEW.md." + artifacts: + - path: "modules/cabana/backend_roles_admin.go" + issue: "FormBeforeCreate (158-166) and FormBeforeUpdate (171-188) accept a new code that code-declared grants attach to; checkCode (193-206) only checks uniqueness" + - path: "modules/cabana/backend_privileges.go" + issue: "roleGrantSet / grantsCovered exist but are not applied to a role's new code" + missing: + - "Refuse, in both Roles hooks, a new code with len(reg.rolePermissions(newCode)) > 0 when newCode != storedCode (stricter, matches D-16: a role never becomes a code-declared system role through the screen), or at minimum require actsAsSuperuser or grantsCovered(editor grants, rolePermissions(newCode))" + - "Postgres regression test: a non-superuser holding backend.manage_roles renames (and creates) a role onto a code-declared code and gets 403/422 with the role row unchanged; add it to the REQUIRE list in scripts/check-phase19.6.1.sh" + - truth: "D-19: a non-superuser holding backend.manage_users gets 403 user.outranked when running a record action on a non-superuser admin whose effective grants they do not cover" + status: partial + reason: "The built-in lifecycle actions call guardOutranked themselves, but record actions contributed through pact.HasAdminActionExtensions to summercms.cabana.users run through CRUDService.RecordAction with only the target's RequiredPermissions, their own Permissions and Applies; compileActionExtensions does not wrap them with guardOutranked, and the guard is unexported so a contributor cannot call it. Reproduced: an editor holding backend.manage_users + the action's permission got 403 outranked for the built-in deactivate on an outranking target and 200 (action ran) for the contributed acme_ping on the same target. The seam's stated first consumer (19.7 D-07/D-34 link action, 'a holder can set a link') would let a manage_users holder bind their own frontend account to an administrator who outranks them, the takeover D-19 was written to close. Confirmed WR-03 from 19.6.1-REVIEW.md. The D-09 half of WR-03 does not defeat D-09: superuser targets are 404 for non-superusers through FormExtendQuery and every framework reducing path is guarded." + artifacts: + - path: "modules/cabana/action_extensions.go" + issue: "contributed actions targeting AdministratorsControllerID are merged without the D-19 guard" + - path: "modules/pact/capabilities.go" + issue: "AdminActionExtension docs say nothing about the Administrators screen's privilege rules" + missing: + - "When compiling extensions whose target is AdministratorsControllerID, wrap each contributed Run so guardOutranked(ctx, reg, principal, record.(*BackendUser)) runs inside the action transaction before the contributor's Run (or export a cabana guard helper and document it as required)" + - "Postgres test: a contributed action on an outranking target answers 403 user.outranked and Run is not called; add it to the gate's REQUIRE list" +deferred: [] +human_verification: + - test: "Sign in as a superuser, open Settings -> System -> Administrators and Roles; create an administrator (password + confirmation), edit it, deactivate, delete, filter deleted, restore; open another superuser and confirm the Permission overrides editor is read-only with the trigger note and becomes editable when Superuser is switched off; on Roles create a role, edit permissions, try deleting a held role and a system role" + expected: "Screens render through the generic SPA renderer, status callouts and actions follow UI-SPEC precedence, toasts show the server refusal text, trigger note and record-lock notes render as text" + why_human: "Visual SPA behaviour; Plan 02 and 03 SUMMARYs list this manual browser check as still owed (VALIDATION.md Manual-Only row)" + - test: "Sign in as a limited admin holding only backend.manage_users (then only backend.manage_roles) and open the same screens" + expected: "Only the matching Settings tile shows; no Superuser switch, column or filter; superusers never listed; permission rows the admin lacks show locked; roles above their ceiling are locked in the role picker; own record shows locked permissions and no Deactivate; own password field refused with the My Account hint" + why_human: "Visual check of per-principal schema and lock rendering in the real SPA" + - test: "Review the 14 judgment-tier prohibitions in Plans 01-03 (listed under Prohibitions in the report) and confirm or reject the LLM-judge verdicts" + expected: "Each prohibition confirmed as held" + why_human: "unverified-prohibition: human review recommended (judgment tier, verdicts here are non-authoritative)" +--- + +# Phase 19.6.1: Backend Administrators screen Verification Report + +**Phase Goal:** cabana gets WinterCMS's Administrators screens, so backend admins and their roles are managed in the admin SPA instead of only through `admin:*` console commands. It reuses cabana's CRUD, permission field and record actions, and follows the sm-user-plugin Users/Groups screens and WinterCMS `Backend\Controllers\Users`/`UserRoles`. +**Verified:** 2026-10-22T10:55:00Z +**Status:** gaps_found +**Re-verification:** No, initial verification + +## Goal Achievement + +The screens exist, are wired and are well tested: 31 named Postgres tests and the SC-1 regression set pass in the verifier's own run of the phase gate. Two privilege holes remain, and both are reproduced against the running handler: + +- **CR-01, a blocker.** A non-superuser can raise their own permissions by renaming their role's code. This defeats SC-2 and D-07. +- **WR-03, a gap.** Record actions contributed through the D-14 seam skip the D-19 outranking guard. + +### Observable Truths + +| # | Truth | Status | Evidence | +|---|-------|--------|----------| +| SC-1 | Admin with manage-administrators lists/creates/edits/deactivates backend users and edits roles with the permission editor; existing payloads and `admin:*` commands unchanged | ✓ VERIFIED (server) + human visual check | YAML screens in `modules/cabana/backendscreens/`, controllers `backend_users_admin.go`, `backend_roles_admin.go`; gate `--sc1`: 23 commits since 88ec4df, none touch commands.go/token_commands.go/account.go; TestAdminCreateCommand, TestAdminResetPasswordCommand, account, auth, OpenAPI conformance pass; new payload keys `permissionLocks,omitempty` and `trigger` omitempty | +| SC-2 | Only a superuser can create/edit/grant superuser; an admin cannot raise their own role or permissions; last active superuser protected | ✗ FAILED | The superuser and last-superuser parts hold (TestAdministratorsSuperuserFlag, TestAdministratorsLastSuperuser*). "Cannot raise their own permissions" is false: a verifier repro (temporary test, deleted) shows a `backend.manage_roles`-only editor renaming their own role onto a code-declared code, PUT 200, and the plugin grant attached to the role (CR-01) | +| SC-3 | Record-action seam usable by plugins; unit tests cover privilege rules | ✓ VERIFIED | `pact.HasAdminActionExtensions` / `AdminActionExtension` (capabilities.go:378-408); `compileActionExtensions(reg, plugins)` called at http.go:137 before compileContributions; TestActionExtensionBoot, TestActionExtensionRun pass. The seam's privilege gap is recorded under D-19 | +| D-01 | `backend.manage_users`, `backend.manage_roles` registered by internal pseudo-plugin | ✓ VERIFIED | backend_screens.go:82-87; TestBackendScreensActivation | +| D-02 | Settings → System placement, no navigation item | ✓ VERIFIED | backend_screens.go:91-113 (orders 100/110); no HasNavigation | +| D-03 | Superusers hidden from non-superusers | ✓ VERIFIED | `scopeAdministrators` on ListExtendQuery and FormExtendQuery; `hiddenSchemaFields` wired at http.go:784/879; TestAdministratorsSuperuserHidden. Note: DELETE of a hidden superuser id answers 200 deleted 0, the same as a missing id, and writes nothing | +| D-04 | No default role grant | ✓ VERIFIED | Permissions() carries no Roles; TestBackendScreensActivation checks developer/publisher hold neither code | +| D-05 | Only superuser sets is_superuser; non-superuser sending it gets 403 | ✓ VERIFIED | FormBeforeCreate/Update check the virtual field (backend_users_admin.go:733-741, 777-781); TestAdministratorsSuperuserFlag | +| D-06 | Per-user radio permission override, disabled while superuser on | ✓ VERIFIED | fields.yaml `permissioneditor mode: radio` + `trigger: {action: disable, field: is_superuser, condition: checked}`; field_trigger.go; SPA trigger.ts + FormView applyTriggers; vitest trigger/FormView backstops | +| D-07 | Non-superuser can't grant more than they hold (permissions, role picker, Roles screen) | ✗ FAILED | Permission editor Locked and role-picker ceiling work (TestAdministratorsPermissionCeiling, TestAdministratorsRoleCeiling, TestRolesPermissionCeiling). The Roles screen ceiling is bypassed through the role **code**: a rename or create onto a code with code-declared grants adds permissions the editor lacks to the role (CR-01, reproduced) | +| D-08 | Own record: profile editable; role/superuser/permissions/activation/delete refused | ✓ VERIFIED | FormAfterUpdate role compare, AdminSetPermissionValues self refusal, self_delete, self_deactivate; TestAdministratorsSelfEdit | +| D-09 | Last active superuser protected on every write path under lock | ✓ VERIFIED (behavioral) | guardLastSuperuser with pg_advisory_xact_lock after the row lock; called on update demotion, deactivate (record + bulk), delete (form + bulk). TestAdministratorsLastSuperuser (held-lock race on 5 paths) and TestAdministratorsLastSuperuserConcurrent passed in the verifier's own gate run. IN-01 (relies on READ COMMITTED) recorded as info | +| D-10 | Deactivate + soft delete + restore, no hard delete | ✓ VERIFIED | lifecycles(); soft delete via deleted_at; TestAdministratorsLifecycle asserts no row disappears | +| D-11 | Password typed in form, required on create, bcrypt | ✓ VERIFIED | FormRules + storePassword (min 4 chars enforced locally, 72-byte max); TestAdministratorsPasswordAndIdentity | +| D-12 | Deactivate/delete/password-set bump tokens_valid_after | ✓ VERIFIED | revocationCutoff on deactivate, FormAfterDelete, FormBeforeUpdate password; TestAdministratorsRevocation | +| D-13 | No invite or welcome mail | ✓ VERIFIED | No mail calls in backend_users_admin.go | +| D-14 | Generic cross-controller action extension with boot errors | ✓ VERIFIED | action_extensions.go; TestActionExtensionBoot covers unknown controller, no preview, duplicates, reserved name, nil Run, empty label, unknown permission | +| D-15 | Contributed actions on preview only | ✓ VERIFIED | compileActionExtensions requires `cc.Form.preview`; users config_form.yaml has `preview.headerPartial: hint` | +| D-16 | Roles fields; system roles code locked, code-declared grants shown locked | ✓ VERIFIED | userrole/fields.yaml (checkbox editor, slug preset); systemRole(); AdminPermissionRecordLocks; TestRolesLifecycle, TestRolesCodeDeclaredLocks. The CR-01 root cause also lets a non-superuser **make** a role a system role, recorded under D-07 | +| D-17 | Held role or system role cannot be deleted | ✓ VERIFIED | FormBeforeDelete counts holders unscoped; TestRolesLifecycle (count message, bulk rollback) | +| D-18 | Unit tests last plan; docs updated | ✓ VERIFIED | Plan 03 tests; cabana/pact READMEs and docs/backend pages updated; gate docs stage (orchestrator `--all` exit 0) | +| D-19 | No outranking on update/delete/record/bulk actions | ✗ FAILED (partial) | Built-in update, delete and lifecycle actions are guarded (TestAdministratorsOutranked). Contributed record actions on summercms.cabana.users are not: the verifier repro got 403 for the built-in deactivate and 200 for the contributed acme_ping on the same outranking target (WR-03) | +| D-20 | Own password refused on this screen | ✓ VERIFIED | FormBeforeUpdate own_password; TestAdministratorsOwnPassword | +| D-21 | SPA support: field trigger + per-record locked permission values | ✓ VERIFIED | field_trigger.go, PermissionRecordLockProvider, RecordMeta.PermissionLocks omitempty, trigger.ts, data-locked-by; Go and SPA tests; orchestrator reports vitest 1461/1461 and gate admin stage (openapi/dist checks) green | +| D-22 | Three-plan split | ✓ VERIFIED | 01 server, 02 SPA, 03 tests | + +**Score:** 22/25 truths verified (0 present but behavior-unverified) + +### Required Artifacts + +| Artifact | Expected | Status | Details | +|----------|----------|--------|---------| +| `modules/pact/capabilities.go` | AdminActionExtension, HasAdminActionExtensions | ✓ VERIFIED | lines 378-408 | +| `modules/cabana/action_extensions.go` | compileActionExtensions | ✓ VERIFIED (wiring gap under D-19) | wired at http.go:137 | +| `modules/cabana/backend_screens.go` | pseudo-plugin, AdministratorsControllerID | ✓ VERIFIED | appended by withBackendScreens after the no-controllers return | +| `modules/cabana/backend_users_admin.go` | controller with hooks, FormAfterUpdate | ✓ VERIFIED | 922 lines, substantive | +| `modules/cabana/backend_roles_admin.go` | roles controller, FormBeforeDelete | ⚠️ VERIFIED with gap | CR-01 code check missing | +| `modules/cabana/backend_privileges.go` | guards, pg_advisory_xact_lock | ✓ VERIFIED | | +| `modules/cabana/backendscreens/models/user/fields.yaml` | permissioneditor | ✓ VERIFIED | radio + trigger | +| `modules/cabana/backend_screens_smoke_test.go` | TestBackendScreensPostgresSmoke | ✓ VERIFIED | passes in gate | +| `modules/cabana/field_trigger.go` | FieldTrigger | ✓ VERIFIED | | +| `modules/cabana/field_permission.go` | PermissionRecordLockProvider | ✓ VERIFIED | | +| `modules/cabana/relation_field.go` | permissionLocks,omitempty | ✓ VERIFIED | line 116 | +| `admin/src/components/form/trigger.ts` | applyTriggers | ✓ VERIFIED | used by FormView.vue:142 and PreviewView.vue:79 | +| `admin/src/components/form/fields/PermissionEditorField.vue` | data-locked-by | ✓ VERIFIED | line 173; no v-html | +| `modules/boardwalk/dist` | rebuilt dist | ✓ VERIFIED (per gate admin stage, orchestrator run) | | +| `modules/cabana/administrators_harness_test.go` etc. | Plan 03 tests | ✓ VERIFIED | all named tests pass | +| `scripts/check-phase19.6.1.sh` | fail-closed gate | ✓ VERIFIED | REQUIRE lists by name | + +### Key Link Verification + +| From | To | Via | Status | +|------|----|-----|--------| +| http.go | action_extensions.go | `compileActionExtensions(reg, plugins)` before compileContributions | ✓ WIRED | +| http.go | backend_screens.go | `withBackendScreens(` after `len(items)==0` return | ✓ WIRED | +| backend_users_admin.go | backend_privileges.go | `guardLastSuperuser(` on update, deactivate, delete | ✓ WIRED | +| crud.go | backend_users_admin.go | `extendRecordData(` in projectFullRecord | ✓ WIRED | +| http.go | backend_users_admin.go | `hiddenSchemaFields(` for form and list schema | ✓ WIRED | +| crud.go | field_permission.go | `AdminPermissionRecordLocks(` | ✓ WIRED | +| FormView.vue | trigger.ts | `applyTriggers(` | ✓ WIRED | +| formState.ts | control.ts | `permissionValues(` with record-locked codes | ✓ WIRED | +| user/fields.yaml | field_trigger.go | `field: is_superuser` | ✓ WIRED | +| lifecycle test | export_test.go | SuperuserLockKey | ✓ WIRED | +| action_extensions.go | backend_privileges.go | guardOutranked for contributed actions on Administrators | ✗ NOT WIRED (WR-03) | + +### Behavioral Spot-Checks + +| Behavior | Command | Result | Status | +|----------|---------|--------|--------| +| CR-01: non-superuser renames own role onto a code-declared code | temporary `TestZZVerifierCR01` (deleted after the run) via `go test ./modules/cabana -run '^TestZZVerifier'` | PUT 200; response `meta.permissionLocks` lists `acme.vrf.secret` as granted to the role | ✗ FAIL (escalation confirmed) | +| WR-03: contributed action on an outranking target | temporary `TestZZVerifierWR03` | built-in deactivate 403 outranked; contributed acme_ping 200 and ran on the target | ✗ FAIL (D-19 bypass confirmed) | +| Every Plan 01/03 Postgres rule test + SC-1 regression + surf | `bash scripts/check-phase19.6.1.sh --docker` | 21 + 10 + 162 top-level tests passed | ✓ PASS | + +### Probe Execution + +| Probe | Command | Result | Status | +|-------|---------|--------|--------| +| `scripts/check-phase19.6.1.sh --sc1` | `bash scripts/check-phase19.6.1.sh --sc1` | exit 0, "no phase commit touches commands.go, token_commands.go, account.go" | PASS | +| `scripts/check-phase19.6.1.sh --docker` | `bash scripts/check-phase19.6.1.sh --docker` | exit 0 | PASS | +| `scripts/check-phase19.6.1.sh --all` | orchestrator / Plan 03 run | exit 0 (not re-run by the verifier: admin build and browser stage) | PASS (reported) | + +The gate is green and the CR-01 and WR-03 repros still fail, because the gate's required tests never cover a role code change onto a code-declared code made by a non-superuser, or a contributed action on an outranking target. + +### Requirements Coverage + +REQUIREMENTS.md maps no IDs to 19.6.1 (no orphaned requirements). The plan `requirements` fields cover SC-1..SC-3 and D-01..D-22. Every ID is accounted for in the truths table: + +| ID | Source Plan | Status | +|----|-------------|--------| +| SC-1 | 01, 02, 03 | SATISFIED (server) + human visual check | +| SC-2 | 01, 02, 03 | BLOCKED (CR-01) | +| SC-3 | 01, 03 | SATISFIED | +| D-01..D-06, D-08..D-18, D-20..D-22 | 01/02/03 | SATISFIED | +| D-07 | 01, 03 | BLOCKED (CR-01) | +| D-19 | 01, 03 | PARTIAL (WR-03) | + +### Prohibitions (judgment tier, verdicts not authoritative, flagged for human review) + +| Plan | Prohibition | LLM-judge verdict | +|------|-------------|-------------------| +| 01 | Existing payloads unchanged; commands.go/token_commands.go/account.go not modified | holds (gate sc1; new keys omitempty) | +| 01 | No hard delete of backend users | holds (soft delete; lifecycle test) | +| 01 | Neither code granted to any role in code | holds | +| 01 | No invite/reset-link/force-change/impersonation/groups/per-row menu/nav item | holds (none found) | +| 01 | No consuming app named; no new dependency; goccy/go-yaml | holds (gate docs stage, reported) | +| 02 | SPA never the enforcement point | holds (server record-lock save rule, trigger-disabled field keeps stored value) | +| 02 | No new npm dependency/token/icon/.vue file | not independently re-checked; reported in SUMMARY | +| 02 | Notes never v-html | holds (no v-html in PermissionEditorField.vue / FormField.vue) | +| 02 | Payloads of other controllers unchanged | holds (omitempty) | +| 03 | No production change except test-proven fixes | holds (two fixes recorded as deviations) | +| 03 | Tests seed and clean their own rows | holds (harness cleanup) | +| 03 | Docker-unrunnable test reported NOT RUN | holds (gate docker_gate) | + +### Anti-Patterns Found + +| File | Line | Pattern | Severity | Impact | +|------|------|---------|----------|--------| +| modules/cabana/backend_roles_admin.go | 158-206 | New role code not checked against code-declared grants (CR-01) | 🛑 Blocker | SC-2/D-07 self-escalation | +| modules/cabana/action_extensions.go | 23-70 | Contributed actions on Administrators bypass guardOutranked (WR-03) | 🛑 Blocker (D-19 must-have) | Takeover path for the seam's first consumer (19.7 link action) | +| modules/cabana/backend_users_admin.go, backend_privileges.go | 508-571, 123-146 | Ceilings use the owner's full grants under a scoped personal token (WR-01) | ⚠️ Warning | A scoped token can create administrators with the owner's full grants. Hardening; does not on its face break a must-have | +| modules/cabana/backend_users_admin.go | 584-660 | Stored override values other than 1/-1 dropped on save (WR-02) | ⚠️ Warning | Needs rows written outside the screen; can re-grant a removed permission | +| modules/cabana/backend_privileges.go | 148-178 | Last-superuser count relies on READ COMMITTED (IN-01) | ℹ️ Info | | +| modules/cabana/backend_users_admin.go / crud.go | 199-232 | Re-delete of a trashed admin reports success, bumps tokens (IN-02) | ℹ️ Info | | +| modules/cabana/backend_roles_admin.go | 190-241 | Unlocked code-uniqueness and holder count (IN-03, IN-04) | ℹ️ Info | | +| modules/cabana/backend_users_admin.go | 705-718 | toggleOn reads unknown encodings as off (IN-05) | ℹ️ Info | | +| modules/cabana/backend_users_admin.go | 504-535 | Own role picker editable, refused only on save (IN-06) | ℹ️ Info | UX | + +No TBD/FIXME/XXX/TODO/HACK markers in the phase's implementation files. + +### Human Verification Required + +1. **Superuser walk-through of both screens.** Create, edit, deactivate, delete, restore and filter administrators. Check the Permission overrides trigger on a superuser target, the role CRUD, and the refusals for a held role and a system role. Expected: rendering, callouts and toasts as in UI-SPEC. Why human: this is the visual SPA check that Plans 02 and 03 still owe. +2. **Limited-admin walk-through.** Use an admin holding only `backend.manage_users`, then one holding only `backend.manage_roles`. Expected: the correct tiles show, superuser UI is absent, locked rows and locked roles appear, and the own-record locks hold. Why human: per-principal rendering in the real SPA. +3. **Prohibition review.** Confirm the judgment-tier prohibitions above. They are flagged as unverified prohibitions, and a human review is recommended. + +### Gaps Summary + +Both gaps come from one root cause: privilege enforcement is attached to specific fields and to the built-in actions, not to every input that changes what an administrator can do. + +1. **CR-01 (blocker, SC-2 and D-07).** A role's code is a privilege-bearing input, because code-declared grants attach by code, yet the Roles hooks only check that the code is unique. A non-superuser holding `backend.manage_roles` can rename their own role, or any role, onto a code with code-declared grants. They then gain permissions they never held, and the role becomes a locked system role. The verifier reproduced this against the assembled handler on Postgres. Fix: refuse such a code in FormBeforeCreate and FormBeforeUpdate, and add a regression test to the gate. +2. **WR-03 (gap, D-19).** The D-14 seam merges contributed record actions onto the Administrators screen without the outranking guard, and the guard is unexported, so contributors cannot apply it themselves. The verifier reproduced this: the built-in deactivate answers 403 on an outranking target, and the contributed action answers 200. 19.7's link action is the stated first consumer and would inherit the hole. Fix: wrap contributed Runs targeting `summercms.cabana.users` with guardOutranked inside the action transaction, or export a required guard helper, and add a test. + + If the developer decides instead that contributors own their authorization, record that as an override: + + ```yaml + overrides: + - must_have: "D-19: a non-superuser holding backend.manage_users gets 403 user.outranked when running a record action on a non-superuser admin whose effective grants they do not cover" + reason: "Contributed actions are responsible for their own authorization; an exported guard helper ships with 19.7" + accepted_by: "{name}" + accepted_at: "{ISO timestamp}" + ``` + + This is a weaker position for a published `pact` capability. + +WR-01 and WR-02 are hardening warnings and do not block. The IN-01 to IN-06 items are informational. None of the gaps is covered by a later phase's success criteria. 19.7 consumes the seam but does not plan to guard it. + +--- + +_Verified: 2026-10-22T10:55:00Z_ +_Verifier: Claude (msd-verifier)_