golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(19.6.1): verification report, gaps found (22/25)

Browse Source
This commit is contained in:
Jakub Zych
2026-10-22 12:45:01 +02:00
parent d6a6e7ac60
commit cfebbacc3d
1 changed files with 301 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

301
.planning/phases/19.6.1-backend-administrators-screen/19.6.1-VERIFICATION.md Normal file
View File

@@ -0,0 +1,301 @@
---
phase: 19.6.1-backend-administrators-screen
verified: 2026-10-22T10:55:00Z
status: gaps_found
score: 22/25 must-haves verified
covered_files:
- .planning/phases/19.6.1-backend-administrators-screen/19.6.1-01-PLAN.md
- .planning/phases/19.6.1-backend-administrators-screen/19.6.1-01-SUMMARY.md
- .planning/phases/19.6.1-backend-administrators-screen/19.6.1-02-PLAN.md
- .planning/phases/19.6.1-backend-administrators-screen/19.6.1-02-SUMMARY.md
- .planning/phases/19.6.1-backend-administrators-screen/19.6.1-03-PLAN.md
- .planning/phases/19.6.1-backend-administrators-screen/19.6.1-03-SUMMARY.md
- admin/openapi/admin.json
- admin/src/api/schema.d.ts
- admin/src/api/types.ts
- admin/src/components/form/FormField.vue
- admin/src/components/form/control.ts
- admin/src/components/form/fields/PermissionEditorField.vue
- admin/src/components/form/formContext.ts
- admin/src/components/form/formState.ts
- admin/src/components/form/trigger.ts
- admin/src/components/relation/RelationChildModal.vue
- admin/src/views/FormView.vue
- admin/src/views/PreviewView.vue
- admin/tests/browser/record-actions-wrap.test.ts
- admin/tests/form/FormView.test.ts
- admin/tests/form/PermissionEditorField.test.ts
- admin/tests/form/PreviewView.test.ts
- admin/tests/form/formState.test.ts
- admin/tests/form/trigger.test.ts
- admin/vitest.browser.config.ts
- docs/backend/admin-controllers.md
- docs/backend/forms.md
- docs/backend/users-and-permissions.md
- modules/cabana/README.md
- modules/cabana/action_extensions.go
- modules/cabana/action_extensions_postgres_test.go
- modules/cabana/action_extensions_test.go
- modules/cabana/admin_openapi.go
- modules/cabana/administrators_harness_test.go
- modules/cabana/administrators_lifecycle_postgres_test.go
- modules/cabana/administrators_postgres_test.go
- modules/cabana/backend_privileges.go
- modules/cabana/backend_privileges_internal_test.go
- modules/cabana/backend_roles_admin.go
- modules/cabana/backend_screens.go
- modules/cabana/backend_screens_smoke_test.go
- modules/cabana/backend_screens_test.go
- modules/cabana/backend_users_admin.go
- modules/cabana/backendscreens/controllers/roles/config_form.yaml
- modules/cabana/backendscreens/controllers/roles/config_list.yaml
- modules/cabana/backendscreens/controllers/users/_hint.htm
- modules/cabana/backendscreens/controllers/users/config_filter.yaml
- modules/cabana/backendscreens/controllers/users/config_form.yaml
- modules/cabana/backendscreens/controllers/users/config_list.yaml
- modules/cabana/backendscreens/models/user/columns.yaml
- modules/cabana/backendscreens/models/user/fields.yaml
- modules/cabana/backendscreens/models/userrole/columns.yaml
- modules/cabana/backendscreens/models/userrole/fields.yaml
- modules/cabana/contracts.go
- modules/cabana/crud.go
- modules/cabana/example_action_extension_test.go
- modules/cabana/example_permission_record_locks_test.go
- modules/cabana/export_test.go
- modules/cabana/field_dependent.go
- modules/cabana/field_permission.go
- modules/cabana/field_repeater.go
- modules/cabana/field_trigger.go
- modules/cabana/field_trigger_smoke_test.go
- modules/cabana/field_trigger_test.go
- modules/cabana/form_schema.go
- modules/cabana/http.go
- modules/cabana/record_locks_smoke_test.go
- modules/cabana/record_locks_test.go
- modules/cabana/registry.go
- modules/cabana/relation_child.go
- modules/cabana/relation_field.go
- modules/cabana/roles_postgres_test.go
- modules/cabana/schema_types.go
- modules/pact/README.md
- modules/pact/capabilities.go
- modules/phrasebook/backend/lang/en/lang.yaml
- modules/phrasebook/backend/lang/pl/lang.yaml
- scripts/check-phase19.6.1.sh
covered_digest: "v2:sha256:ce2ffee04211fae3f2b7542d45027b90d65bf4327d8f280ad470e804da6c4700"
behavior_unverified: 0
overrides_applied: 0
gaps:
- truth: "SC-2 / D-07: an admin cannot raise their own role or permissions, and a non-superuser cannot add a permission they lack to any role (Roles screen ceiling)"
status: failed
reason: "Code-declared grants (pact.Permission.Roles) attach to a role by its code string, and code is fillable on the Roles screen. rolesAdmin.FormBeforeCreate only checks code uniqueness; FormBeforeUpdate only refuses a code change when the STORED role is a system role. Neither checks the NEW code against reg.rolePermissions(newCode) nor against the editor's grants. A non-superuser holding only backend.manage_roles renamed their own role onto a code a plugin declares grants for: PUT answered 200, the response's meta.permissionLocks now lists the plugin grant as granted to the role, and FindByID (auth.go:55) merges it into every holder's grants on the next request, the editor included. The role also becomes a system role (code now locked), so the editor's change cannot be undone through the screen. Precondition: a code-declared role code with no row (nothing at boot validates that pact.Permission.Roles codes match backend_user_roles rows; the developer/publisher seed is ON CONFLICT (name) DO NOTHING). Confirmed CR-01 from 19.6.1-REVIEW.md."
artifacts:
- path: "modules/cabana/backend_roles_admin.go"
issue: "FormBeforeCreate (158-166) and FormBeforeUpdate (171-188) accept a new code that code-declared grants attach to; checkCode (193-206) only checks uniqueness"
- path: "modules/cabana/backend_privileges.go"
issue: "roleGrantSet / grantsCovered exist but are not applied to a role's new code"
missing:
- "Refuse, in both Roles hooks, a new code with len(reg.rolePermissions(newCode)) > 0 when newCode != storedCode (stricter, matches D-16: a role never becomes a code-declared system role through the screen), or at minimum require actsAsSuperuser or grantsCovered(editor grants, rolePermissions(newCode))"
- "Postgres regression test: a non-superuser holding backend.manage_roles renames (and creates) a role onto a code-declared code and gets 403/422 with the role row unchanged; add it to the REQUIRE list in scripts/check-phase19.6.1.sh"
- truth: "D-19: a non-superuser holding backend.manage_users gets 403 user.outranked when running a record action on a non-superuser admin whose effective grants they do not cover"
status: partial
reason: "The built-in lifecycle actions call guardOutranked themselves, but record actions contributed through pact.HasAdminActionExtensions to summercms.cabana.users run through CRUDService.RecordAction with only the target's RequiredPermissions, their own Permissions and Applies; compileActionExtensions does not wrap them with guardOutranked, and the guard is unexported so a contributor cannot call it. Reproduced: an editor holding backend.manage_users + the action's permission got 403 outranked for the built-in deactivate on an outranking target and 200 (action ran) for the contributed acme_ping on the same target. The seam's stated first consumer (19.7 D-07/D-34 link action, 'a holder can set a link') would let a manage_users holder bind their own frontend account to an administrator who outranks them, the takeover D-19 was written to close. Confirmed WR-03 from 19.6.1-REVIEW.md. The D-09 half of WR-03 does not defeat D-09: superuser targets are 404 for non-superusers through FormExtendQuery and every framework reducing path is guarded."
artifacts:
- path: "modules/cabana/action_extensions.go"
issue: "contributed actions targeting AdministratorsControllerID are merged without the D-19 guard"
- path: "modules/pact/capabilities.go"
issue: "AdminActionExtension docs say nothing about the Administrators screen's privilege rules"
missing:
- "When compiling extensions whose target is AdministratorsControllerID, wrap each contributed Run so guardOutranked(ctx, reg, principal, record.(*BackendUser)) runs inside the action transaction before the contributor's Run (or export a cabana guard helper and document it as required)"
- "Postgres test: a contributed action on an outranking target answers 403 user.outranked and Run is not called; add it to the gate's REQUIRE list"
deferred: []
human_verification:
- test: "Sign in as a superuser, open Settings -> System -> Administrators and Roles; create an administrator (password + confirmation), edit it, deactivate, delete, filter deleted, restore; open another superuser and confirm the Permission overrides editor is read-only with the trigger note and becomes editable when Superuser is switched off; on Roles create a role, edit permissions, try deleting a held role and a system role"
expected: "Screens render through the generic SPA renderer, status callouts and actions follow UI-SPEC precedence, toasts show the server refusal text, trigger note and record-lock notes render as text"
why_human: "Visual SPA behaviour; Plan 02 and 03 SUMMARYs list this manual browser check as still owed (VALIDATION.md Manual-Only row)"
- test: "Sign in as a limited admin holding only backend.manage_users (then only backend.manage_roles) and open the same screens"
expected: "Only the matching Settings tile shows; no Superuser switch, column or filter; superusers never listed; permission rows the admin lacks show locked; roles above their ceiling are locked in the role picker; own record shows locked permissions and no Deactivate; own password field refused with the My Account hint"
why_human: "Visual check of per-principal schema and lock rendering in the real SPA"
- test: "Review the 14 judgment-tier prohibitions in Plans 01-03 (listed under Prohibitions in the report) and confirm or reject the LLM-judge verdicts"
expected: "Each prohibition confirmed as held"
why_human: "unverified-prohibition: human review recommended (judgment tier, verdicts here are non-authoritative)"
---
# Phase 19.6.1: Backend Administrators screen Verification Report
**Phase Goal:** cabana gets WinterCMS's Administrators screens, so backend admins and their roles are managed in the admin SPA instead of only through `admin:*` console commands. It reuses cabana's CRUD, permission field and record actions, and follows the sm-user-plugin Users/Groups screens and WinterCMS `Backend\Controllers\Users`/`UserRoles`.
**Verified:** 2026-10-22T10:55:00Z
**Status:** gaps_found
**Re-verification:** No, initial verification
## Goal Achievement
The screens exist, are wired and are well tested: 31 named Postgres tests and the SC-1 regression set pass in the verifier's own run of the phase gate. Two privilege holes remain, and both are reproduced against the running handler:
- **CR-01, a blocker.** A non-superuser can raise their own permissions by renaming their role's code. This defeats SC-2 and D-07.
- **WR-03, a gap.** Record actions contributed through the D-14 seam skip the D-19 outranking guard.
### Observable Truths
| # | Truth | Status | Evidence |
|---|-------|--------|----------|
| SC-1 | Admin with manage-administrators lists/creates/edits/deactivates backend users and edits roles with the permission editor; existing payloads and `admin:*` commands unchanged | ✓ VERIFIED (server) + human visual check | YAML screens in `modules/cabana/backendscreens/`, controllers `backend_users_admin.go`, `backend_roles_admin.go`; gate `--sc1`: 23 commits since 88ec4df, none touch commands.go/token_commands.go/account.go; TestAdminCreateCommand, TestAdminResetPasswordCommand, account, auth, OpenAPI conformance pass; new payload keys `permissionLocks,omitempty` and `trigger` omitempty |
| SC-2 | Only a superuser can create/edit/grant superuser; an admin cannot raise their own role or permissions; last active superuser protected | ✗ FAILED | The superuser and last-superuser parts hold (TestAdministratorsSuperuserFlag, TestAdministratorsLastSuperuser*). "Cannot raise their own permissions" is false: a verifier repro (temporary test, deleted) shows a `backend.manage_roles`-only editor renaming their own role onto a code-declared code, PUT 200, and the plugin grant attached to the role (CR-01) |
| SC-3 | Record-action seam usable by plugins; unit tests cover privilege rules | ✓ VERIFIED | `pact.HasAdminActionExtensions` / `AdminActionExtension` (capabilities.go:378-408); `compileActionExtensions(reg, plugins)` called at http.go:137 before compileContributions; TestActionExtensionBoot, TestActionExtensionRun pass. The seam's privilege gap is recorded under D-19 |
| D-01 | `backend.manage_users`, `backend.manage_roles` registered by internal pseudo-plugin | ✓ VERIFIED | backend_screens.go:82-87; TestBackendScreensActivation |
| D-02 | Settings → System placement, no navigation item | ✓ VERIFIED | backend_screens.go:91-113 (orders 100/110); no HasNavigation |
| D-03 | Superusers hidden from non-superusers | ✓ VERIFIED | `scopeAdministrators` on ListExtendQuery and FormExtendQuery; `hiddenSchemaFields` wired at http.go:784/879; TestAdministratorsSuperuserHidden. Note: DELETE of a hidden superuser id answers 200 deleted 0, the same as a missing id, and writes nothing |
| D-04 | No default role grant | ✓ VERIFIED | Permissions() carries no Roles; TestBackendScreensActivation checks developer/publisher hold neither code |
| D-05 | Only superuser sets is_superuser; non-superuser sending it gets 403 | ✓ VERIFIED | FormBeforeCreate/Update check the virtual field (backend_users_admin.go:733-741, 777-781); TestAdministratorsSuperuserFlag |
| D-06 | Per-user radio permission override, disabled while superuser on | ✓ VERIFIED | fields.yaml `permissioneditor mode: radio` + `trigger: {action: disable, field: is_superuser, condition: checked}`; field_trigger.go; SPA trigger.ts + FormView applyTriggers; vitest trigger/FormView backstops |
| D-07 | Non-superuser can't grant more than they hold (permissions, role picker, Roles screen) | ✗ FAILED | Permission editor Locked and role-picker ceiling work (TestAdministratorsPermissionCeiling, TestAdministratorsRoleCeiling, TestRolesPermissionCeiling). The Roles screen ceiling is bypassed through the role **code**: a rename or create onto a code with code-declared grants adds permissions the editor lacks to the role (CR-01, reproduced) |
| D-08 | Own record: profile editable; role/superuser/permissions/activation/delete refused | ✓ VERIFIED | FormAfterUpdate role compare, AdminSetPermissionValues self refusal, self_delete, self_deactivate; TestAdministratorsSelfEdit |
| D-09 | Last active superuser protected on every write path under lock | ✓ VERIFIED (behavioral) | guardLastSuperuser with pg_advisory_xact_lock after the row lock; called on update demotion, deactivate (record + bulk), delete (form + bulk). TestAdministratorsLastSuperuser (held-lock race on 5 paths) and TestAdministratorsLastSuperuserConcurrent passed in the verifier's own gate run. IN-01 (relies on READ COMMITTED) recorded as info |
| D-10 | Deactivate + soft delete + restore, no hard delete | ✓ VERIFIED | lifecycles(); soft delete via deleted_at; TestAdministratorsLifecycle asserts no row disappears |
| D-11 | Password typed in form, required on create, bcrypt | ✓ VERIFIED | FormRules + storePassword (min 4 chars enforced locally, 72-byte max); TestAdministratorsPasswordAndIdentity |
| D-12 | Deactivate/delete/password-set bump tokens_valid_after | ✓ VERIFIED | revocationCutoff on deactivate, FormAfterDelete, FormBeforeUpdate password; TestAdministratorsRevocation |
| D-13 | No invite or welcome mail | ✓ VERIFIED | No mail calls in backend_users_admin.go |
| D-14 | Generic cross-controller action extension with boot errors | ✓ VERIFIED | action_extensions.go; TestActionExtensionBoot covers unknown controller, no preview, duplicates, reserved name, nil Run, empty label, unknown permission |
| D-15 | Contributed actions on preview only | ✓ VERIFIED | compileActionExtensions requires `cc.Form.preview`; users config_form.yaml has `preview.headerPartial: hint` |
| D-16 | Roles fields; system roles code locked, code-declared grants shown locked | ✓ VERIFIED | userrole/fields.yaml (checkbox editor, slug preset); systemRole(); AdminPermissionRecordLocks; TestRolesLifecycle, TestRolesCodeDeclaredLocks. The CR-01 root cause also lets a non-superuser **make** a role a system role, recorded under D-07 |
| D-17 | Held role or system role cannot be deleted | ✓ VERIFIED | FormBeforeDelete counts holders unscoped; TestRolesLifecycle (count message, bulk rollback) |
| D-18 | Unit tests last plan; docs updated | ✓ VERIFIED | Plan 03 tests; cabana/pact READMEs and docs/backend pages updated; gate docs stage (orchestrator `--all` exit 0) |
| D-19 | No outranking on update/delete/record/bulk actions | ✗ FAILED (partial) | Built-in update, delete and lifecycle actions are guarded (TestAdministratorsOutranked). Contributed record actions on summercms.cabana.users are not: the verifier repro got 403 for the built-in deactivate and 200 for the contributed acme_ping on the same outranking target (WR-03) |
| D-20 | Own password refused on this screen | ✓ VERIFIED | FormBeforeUpdate own_password; TestAdministratorsOwnPassword |
| D-21 | SPA support: field trigger + per-record locked permission values | ✓ VERIFIED | field_trigger.go, PermissionRecordLockProvider, RecordMeta.PermissionLocks omitempty, trigger.ts, data-locked-by; Go and SPA tests; orchestrator reports vitest 1461/1461 and gate admin stage (openapi/dist checks) green |
| D-22 | Three-plan split | ✓ VERIFIED | 01 server, 02 SPA, 03 tests |
**Score:** 22/25 truths verified (0 present but behavior-unverified)
### Required Artifacts
| Artifact | Expected | Status | Details |
|----------|----------|--------|---------|
| `modules/pact/capabilities.go` | AdminActionExtension, HasAdminActionExtensions | ✓ VERIFIED | lines 378-408 |
| `modules/cabana/action_extensions.go` | compileActionExtensions | ✓ VERIFIED (wiring gap under D-19) | wired at http.go:137 |
| `modules/cabana/backend_screens.go` | pseudo-plugin, AdministratorsControllerID | ✓ VERIFIED | appended by withBackendScreens after the no-controllers return |
| `modules/cabana/backend_users_admin.go` | controller with hooks, FormAfterUpdate | ✓ VERIFIED | 922 lines, substantive |
| `modules/cabana/backend_roles_admin.go` | roles controller, FormBeforeDelete | ⚠️ VERIFIED with gap | CR-01 code check missing |
| `modules/cabana/backend_privileges.go` | guards, pg_advisory_xact_lock | ✓ VERIFIED | |
| `modules/cabana/backendscreens/models/user/fields.yaml` | permissioneditor | ✓ VERIFIED | radio + trigger |
| `modules/cabana/backend_screens_smoke_test.go` | TestBackendScreensPostgresSmoke | ✓ VERIFIED | passes in gate |
| `modules/cabana/field_trigger.go` | FieldTrigger | ✓ VERIFIED | |
| `modules/cabana/field_permission.go` | PermissionRecordLockProvider | ✓ VERIFIED | |
| `modules/cabana/relation_field.go` | permissionLocks,omitempty | ✓ VERIFIED | line 116 |
| `admin/src/components/form/trigger.ts` | applyTriggers | ✓ VERIFIED | used by FormView.vue:142 and PreviewView.vue:79 |
| `admin/src/components/form/fields/PermissionEditorField.vue` | data-locked-by | ✓ VERIFIED | line 173; no v-html |
| `modules/boardwalk/dist` | rebuilt dist | ✓ VERIFIED (per gate admin stage, orchestrator run) | |
| `modules/cabana/administrators_harness_test.go` etc. | Plan 03 tests | ✓ VERIFIED | all named tests pass |
| `scripts/check-phase19.6.1.sh` | fail-closed gate | ✓ VERIFIED | REQUIRE lists by name |
### Key Link Verification
| From | To | Via | Status |
|------|----|-----|--------|
| http.go | action_extensions.go | `compileActionExtensions(reg, plugins)` before compileContributions | ✓ WIRED |
| http.go | backend_screens.go | `withBackendScreens(` after `len(items)==0` return | ✓ WIRED |
| backend_users_admin.go | backend_privileges.go | `guardLastSuperuser(` on update, deactivate, delete | ✓ WIRED |
| crud.go | backend_users_admin.go | `extendRecordData(` in projectFullRecord | ✓ WIRED |
| http.go | backend_users_admin.go | `hiddenSchemaFields(` for form and list schema | ✓ WIRED |
| crud.go | field_permission.go | `AdminPermissionRecordLocks(` | ✓ WIRED |
| FormView.vue | trigger.ts | `applyTriggers(` | ✓ WIRED |
| formState.ts | control.ts | `permissionValues(` with record-locked codes | ✓ WIRED |
| user/fields.yaml | field_trigger.go | `field: is_superuser` | ✓ WIRED |
| lifecycle test | export_test.go | SuperuserLockKey | ✓ WIRED |
| action_extensions.go | backend_privileges.go | guardOutranked for contributed actions on Administrators | ✗ NOT WIRED (WR-03) |
### Behavioral Spot-Checks
| Behavior | Command | Result | Status |
|----------|---------|--------|--------|
| CR-01: non-superuser renames own role onto a code-declared code | temporary `TestZZVerifierCR01` (deleted after the run) via `go test ./modules/cabana -run '^TestZZVerifier'` | PUT 200; response `meta.permissionLocks` lists `acme.vrf.secret` as granted to the role | ✗ FAIL (escalation confirmed) |
| WR-03: contributed action on an outranking target | temporary `TestZZVerifierWR03` | built-in deactivate 403 outranked; contributed acme_ping 200 and ran on the target | ✗ FAIL (D-19 bypass confirmed) |
| Every Plan 01/03 Postgres rule test + SC-1 regression + surf | `bash scripts/check-phase19.6.1.sh --docker` | 21 + 10 + 162 top-level tests passed | ✓ PASS |
### Probe Execution
| Probe | Command | Result | Status |
|-------|---------|--------|--------|
| `scripts/check-phase19.6.1.sh --sc1` | `bash scripts/check-phase19.6.1.sh --sc1` | exit 0, "no phase commit touches commands.go, token_commands.go, account.go" | PASS |
| `scripts/check-phase19.6.1.sh --docker` | `bash scripts/check-phase19.6.1.sh --docker` | exit 0 | PASS |
| `scripts/check-phase19.6.1.sh --all` | orchestrator / Plan 03 run | exit 0 (not re-run by the verifier: admin build and browser stage) | PASS (reported) |
The gate is green and the CR-01 and WR-03 repros still fail, because the gate's required tests never cover a role code change onto a code-declared code made by a non-superuser, or a contributed action on an outranking target.
### Requirements Coverage
REQUIREMENTS.md maps no IDs to 19.6.1 (no orphaned requirements). The plan `requirements` fields cover SC-1..SC-3 and D-01..D-22. Every ID is accounted for in the truths table:
| ID | Source Plan | Status |
|----|-------------|--------|
| SC-1 | 01, 02, 03 | SATISFIED (server) + human visual check |
| SC-2 | 01, 02, 03 | BLOCKED (CR-01) |
| SC-3 | 01, 03 | SATISFIED |
| D-01..D-06, D-08..D-18, D-20..D-22 | 01/02/03 | SATISFIED |
| D-07 | 01, 03 | BLOCKED (CR-01) |
| D-19 | 01, 03 | PARTIAL (WR-03) |
### Prohibitions (judgment tier, verdicts not authoritative, flagged for human review)
| Plan | Prohibition | LLM-judge verdict |
|------|-------------|-------------------|
| 01 | Existing payloads unchanged; commands.go/token_commands.go/account.go not modified | holds (gate sc1; new keys omitempty) |
| 01 | No hard delete of backend users | holds (soft delete; lifecycle test) |
| 01 | Neither code granted to any role in code | holds |
| 01 | No invite/reset-link/force-change/impersonation/groups/per-row menu/nav item | holds (none found) |
| 01 | No consuming app named; no new dependency; goccy/go-yaml | holds (gate docs stage, reported) |
| 02 | SPA never the enforcement point | holds (server record-lock save rule, trigger-disabled field keeps stored value) |
| 02 | No new npm dependency/token/icon/.vue file | not independently re-checked; reported in SUMMARY |
| 02 | Notes never v-html | holds (no v-html in PermissionEditorField.vue / FormField.vue) |
| 02 | Payloads of other controllers unchanged | holds (omitempty) |
| 03 | No production change except test-proven fixes | holds (two fixes recorded as deviations) |
| 03 | Tests seed and clean their own rows | holds (harness cleanup) |
| 03 | Docker-unrunnable test reported NOT RUN | holds (gate docker_gate) |
### Anti-Patterns Found
| File | Line | Pattern | Severity | Impact |
|------|------|---------|----------|--------|
| modules/cabana/backend_roles_admin.go | 158-206 | New role code not checked against code-declared grants (CR-01) | 🛑 Blocker | SC-2/D-07 self-escalation |
| modules/cabana/action_extensions.go | 23-70 | Contributed actions on Administrators bypass guardOutranked (WR-03) | 🛑 Blocker (D-19 must-have) | Takeover path for the seam's first consumer (19.7 link action) |
| modules/cabana/backend_users_admin.go, backend_privileges.go | 508-571, 123-146 | Ceilings use the owner's full grants under a scoped personal token (WR-01) | ⚠️ Warning | A scoped token can create administrators with the owner's full grants. Hardening; does not on its face break a must-have |
| modules/cabana/backend_users_admin.go | 584-660 | Stored override values other than 1/-1 dropped on save (WR-02) | ⚠️ Warning | Needs rows written outside the screen; can re-grant a removed permission |
| modules/cabana/backend_privileges.go | 148-178 | Last-superuser count relies on READ COMMITTED (IN-01) | ℹ️ Info | |
| modules/cabana/backend_users_admin.go / crud.go | 199-232 | Re-delete of a trashed admin reports success, bumps tokens (IN-02) | ℹ️ Info | |
| modules/cabana/backend_roles_admin.go | 190-241 | Unlocked code-uniqueness and holder count (IN-03, IN-04) | ℹ️ Info | |
| modules/cabana/backend_users_admin.go | 705-718 | toggleOn reads unknown encodings as off (IN-05) | ℹ️ Info | |
| modules/cabana/backend_users_admin.go | 504-535 | Own role picker editable, refused only on save (IN-06) | ℹ️ Info | UX |
No TBD/FIXME/XXX/TODO/HACK markers in the phase's implementation files.
### Human Verification Required
1. **Superuser walk-through of both screens.** Create, edit, deactivate, delete, restore and filter administrators. Check the Permission overrides trigger on a superuser target, the role CRUD, and the refusals for a held role and a system role. Expected: rendering, callouts and toasts as in UI-SPEC. Why human: this is the visual SPA check that Plans 02 and 03 still owe.
2. **Limited-admin walk-through.** Use an admin holding only `backend.manage_users`, then one holding only `backend.manage_roles`. Expected: the correct tiles show, superuser UI is absent, locked rows and locked roles appear, and the own-record locks hold. Why human: per-principal rendering in the real SPA.
3. **Prohibition review.** Confirm the judgment-tier prohibitions above. They are flagged as unverified prohibitions, and a human review is recommended.
### Gaps Summary
Both gaps come from one root cause: privilege enforcement is attached to specific fields and to the built-in actions, not to every input that changes what an administrator can do.
1. **CR-01 (blocker, SC-2 and D-07).** A role's code is a privilege-bearing input, because code-declared grants attach by code, yet the Roles hooks only check that the code is unique. A non-superuser holding `backend.manage_roles` can rename their own role, or any role, onto a code with code-declared grants. They then gain permissions they never held, and the role becomes a locked system role. The verifier reproduced this against the assembled handler on Postgres. Fix: refuse such a code in FormBeforeCreate and FormBeforeUpdate, and add a regression test to the gate.
2. **WR-03 (gap, D-19).** The D-14 seam merges contributed record actions onto the Administrators screen without the outranking guard, and the guard is unexported, so contributors cannot apply it themselves. The verifier reproduced this: the built-in deactivate answers 403 on an outranking target, and the contributed action answers 200. 19.7's link action is the stated first consumer and would inherit the hole. Fix: wrap contributed Runs targeting `summercms.cabana.users` with guardOutranked inside the action transaction, or export a required guard helper, and add a test.
If the developer decides instead that contributors own their authorization, record that as an override:
```yaml
overrides:
- must_have: "D-19: a non-superuser holding backend.manage_users gets 403 user.outranked when running a record action on a non-superuser admin whose effective grants they do not cover"
reason: "Contributed actions are responsible for their own authorization; an exported guard helper ships with 19.7"
accepted_by: "{name}"
accepted_at: "{ISO timestamp}"
```
This is a weaker position for a published `pact` capability.
WR-01 and WR-02 are hardening warnings and do not block. The IN-01 to IN-06 items are informational. None of the gaps is covered by a later phase's success criteria. 19.7 consumes the seam but does not plan to guard it.
---
_Verified: 2026-10-22T10:55:00Z_
_Verifier: Claude (msd-verifier)_