Enforce permissions in API guards and retire interim access #52

New Issue

fable-5 · 2026-07-04T14:52:25+02:00

fable-5 commented

2026-07-04 14:52:25 +02:00

Context

Every route must pass through the real permission guard; the M2 interim service is deleted.

Scope

Implement the Nest PermissionGuard + decorators (@RequiresPondRole('reader'|'editor'|'pond_admin'), page-level variants) loading grants+labels efficiently (per-request cache; per (user,pond) cache with invalidation on grant/label change), apply to every existing route (ponds, pages, files, labels, search, versions, trash), delete InterimAccessService, and add grant CRUD endpoints (/ponds/:id/grants) guarded by pond_admin.

Acceptance criteria

grep proves InterimAccessService is gone; all routes carry an explicit permission decorator (lint rule or test enumerating routes)
fixture matrix e2e: reader cannot edit, editor cannot manage members, pond admin can, foreign user sees 404/403 consistently
grant changes invalidate the cache (test: revoke then immediate request is denied)
audit log lines for every grant change

Technical notes

permissions.md, security.md (default-closed, audit).
404 vs 403 policy: unauthorized reads return 404 (existence hiding); write attempts on readable pages return 403 — document in the API conventions.

Dependencies

Depends on #51.

Size: ~2 days

Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add de and en), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.

## Context Every route must pass through the real permission guard; the M2 interim service is deleted. ## Scope Implement the Nest `PermissionGuard` + decorators (`@RequiresPondRole('reader'|'editor'|'pond_admin')`, page-level variants) loading grants+labels efficiently (per-request cache; per (user,pond) cache with invalidation on grant/label change), apply to every existing route (ponds, pages, files, labels, search, versions, trash), delete `InterimAccessService`, and add grant CRUD endpoints (`/ponds/:id/grants`) guarded by pond_admin. ## Acceptance criteria - [ ] grep proves `InterimAccessService` is gone; all routes carry an explicit permission decorator (lint rule or test enumerating routes) - [ ] fixture matrix e2e: reader cannot edit, editor cannot manage members, pond admin can, foreign user sees 404/403 consistently - [ ] grant changes invalidate the cache (test: revoke then immediate request is denied) - [ ] audit log lines for every grant change ## Technical notes - permissions.md, security.md (default-closed, audit). - 404 vs 403 policy: unauthorized reads return 404 (existence hiding); write attempts on readable pages return 403 — document in the API conventions. ## Dependencies Depends on #51. **Size**: ~2 days --- *Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add `de` **and** `en`), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.*

fable-5 added this to the M5 — Permissions & quotas milestone 2026-07-04 14:52:25 +02:00

fable-5 added the

auth

backend

labels 2026-07-04 14:52:25 +02:00