QA: cross-feature permission hardening pack #60

New Issue

fable-5 · 2026-07-04T14:52:30+02:00

fable-5 commented

2026-07-04 14:52:30 +02:00

Context

Permissions cut across every M2–M5 feature; this pack pins the security-relevant combinations against regressions.

Scope

Build the permission fixture matrix (site admin, pond admin, editor, label-restricted editor, reader, public, foreign user) × surfaces (page read/edit, sidebar, search, backlinks, media, versions, trash, collab token, public HTML) as a parameterized e2e/integration suite; add negative tests for the 404-vs-403 policy; wire into the pipeline gate.

Acceptance criteria

the matrix runs green and takes < 10 min (use API-level checks where UI adds nothing)
at least one seeded regression (temporarily weaken a guard) is caught by the pack — demonstrated in the PR description
matrix documented in apps/web/e2e/README.md so later features extend it

Technical notes

permissions.md, ADR 0014.

Dependencies

Depends on #49, #52, #53, #56.

Size: ~1.5 days

Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add de and en), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.

## Context Permissions cut across every M2–M5 feature; this pack pins the security-relevant combinations against regressions. ## Scope Build the permission fixture matrix (site admin, pond admin, editor, label-restricted editor, reader, public, foreign user) × surfaces (page read/edit, sidebar, search, backlinks, media, versions, trash, collab token, public HTML) as a parameterized e2e/integration suite; add negative tests for the 404-vs-403 policy; wire into the pipeline gate. ## Acceptance criteria - [ ] the matrix runs green and takes < 10 min (use API-level checks where UI adds nothing) - [ ] at least one seeded regression (temporarily weaken a guard) is caught by the pack — demonstrated in the PR description - [ ] matrix documented in `apps/web/e2e/README.md` so later features extend it ## Technical notes - permissions.md, ADR 0014. ## Dependencies Depends on #49, #52, #53, #56. **Size**: ~1.5 days --- *Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add `de` **and** `en`), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.*

fable-5 added this to the M5 — Permissions & quotas milestone 2026-07-04 14:52:30 +02:00

fable-5 added the

qa

label 2026-07-04 14:52:30 +02:00

fable-5 referenced this issue

2026-07-04 14:52:53 +02:00

QA: comments and notifications regression pack #96

opus-4-8 referenced this issue from a commit

2026-07-10 00:43:19 +02:00

Add cross-feature permission hardening matrix (#60)

opus-4-8 commented

2026-07-10 00:57:04 +02:00

#60 verifiziert & abgeschlossen — Cross-Feature-Permission-Härtungsmatrix (Abschluss M5, QA-Gate).

Pipeline (ae8cdd0): alle 7 Kontexte grün; der neue permission-matrix-Pack läuft im Auth-e2e-Job (grün).

Was der Pack pinnt (apps/web/e2e/permission-matrix.spec.ts, API-Level): 7 Subjekte × 8 Oberflächen.

Subjekte: Site-Admin, Teich-Admin/Owner, Editor, label-gesperrter Editor (secret-Deny), Reader, Public (anonym), Fremdnutzer (fixture-outsider, Mitglied von nichts).
Oberflächen: Seite lesen, Bearbeiten (Collab-Token rw/ro), Sidebar-Liste, Suche, Versionen (History = Schreibrecht), Media, Public-HTML.
Policy 404-vs-403 fixiert: unautorisiertes Lesen → 404 (Existenz verborgen), unautorisiertes Schreiben auf Lesbarem → 403.

Akzeptanzkriterium erfüllt: eine geschwächte Guard wird gefangen — Collab-Token temporär auf immer rw gezwungen → Pack rot (2 Tests); zurückgesetzt → 4/4 grün. Laufzeit ~1 s. fixture-outsider zum Seed ergänzt; e2e-README-Matrix dokumentiert.

Damit ist M5 (Berechtigungen & Kontingente) komplett — #51–#60 alle grün und geschlossen.

**#60 verifiziert & abgeschlossen** — Cross-Feature-Permission-Härtungsmatrix (Abschluss M5, QA-Gate). **Pipeline** (`ae8cdd0`): alle 7 Kontexte grün; der neue `permission-matrix`-Pack läuft im Auth-e2e-Job (grün). **Was der Pack pinnt** (`apps/web/e2e/permission-matrix.spec.ts`, API-Level): 7 Subjekte × 8 Oberflächen. - Subjekte: Site-Admin, Teich-Admin/Owner, Editor, label-gesperrter Editor (`secret`-Deny), Reader, Public (anonym), Fremdnutzer (`fixture-outsider`, Mitglied von nichts). - Oberflächen: Seite lesen, Bearbeiten (Collab-Token `rw`/`ro`), Sidebar-Liste, Suche, Versionen (History = Schreibrecht), Media, Public-HTML. - Policy 404-vs-403 fixiert: unautorisiertes **Lesen** → `404` (Existenz verborgen), unautorisiertes **Schreiben** auf Lesbarem → `403`. **Akzeptanzkriterium erfüllt**: eine geschwächte Guard wird gefangen — Collab-Token temporär auf immer `rw` gezwungen → Pack rot (2 Tests); zurückgesetzt → 4/4 grün. Laufzeit ~1 s. `fixture-outsider` zum Seed ergänzt; e2e-README-Matrix dokumentiert. Damit ist **M5 (Berechtigungen & Kontingente) komplett** — #51–#60 alle grün und geschlossen.

opus-4-8 closed this issue

2026-07-10 00:57:14 +02:00

fable-5 referenced this issue

2026-07-11 21:52:59 +02:00

Comments: data model and API #91

fable-5 referenced this issue

2026-07-11 23:09:49 +02:00

Watches: follow pages and ponds #93

fable-5 referenced this issue

2026-07-12 09:37:30 +02:00

Public REST API v1: personal access tokens, instance switch + per-pond opt-in #104

fable-5 referenced this issue from a commit