Proxy verbs: promote manager-tier guards to sub-verb rows, re-gate clients #135

New issue

Closed

opened 2026-08-18 10:45:26 +00:00 by nalum · 0 comments

nalum commented

2026-08-18 10:45:26 +00:00

Owner

From the RBAC matrix breakdown (2026-08-16), findings 2 and 4.

Both clients elect one verb to "stand for the manager tier" and gate actions it does not name. These break silently if the matrix ever splits a role's verbs, and web and Android even disagree on which wrong verb to use.

Web proxies: Jobs.tsx:224 / Today.tsx:162 (ItemService/Delete gates edit mode, owner reassign, step points → RewardService/Create cross-service), ListDetail.tsx:45 (ItemListService/Update gates UncheckAll, Delete, entry reassign, convert-to-job), Meals.tsx:62-63, Rewards.tsx:88.

Android proxies: ItemSheets.kt:227 / Jobs.kt:80, Home.kt:507 (divergence — proxies the list screen with Create where web uses Update), ItemSheets.kt:1211, Rewards.kt:170, Meals.kt:76 (divergence — meal edit gated on Create; web correctly uses Update), Meals.kt:77.

Proposed fix (extends ADR-0031, needs an ADR update): add sub-verb rows for the role-only halves so clients stop proxying:

the Admin|Member manager bucket behind RequireItemManager (replaces the ItemService/Delete proxy on three surfaces),
Claim.other for admin-claims-on-behalf,
the admin half of non-self ExportUserData.

Then re-gate every proxy site on the verb it actually performs.

From the RBAC matrix breakdown (2026-08-16), findings 2 and 4. Both clients elect one verb to "stand for the manager tier" and gate actions it does not name. These break silently if the matrix ever splits a role's verbs, and web and Android even disagree on which wrong verb to use. Web proxies: `Jobs.tsx:224` / `Today.tsx:162` (`ItemService/Delete` gates edit mode, owner reassign, step points → RewardService/Create cross-service), `ListDetail.tsx:45` (`ItemListService/Update` gates UncheckAll, Delete, entry reassign, convert-to-job), `Meals.tsx:62-63`, `Rewards.tsx:88`. Android proxies: `ItemSheets.kt:227` / `Jobs.kt:80`, `Home.kt:507` (**divergence** — proxies the list screen with `Create` where web uses `Update`), `ItemSheets.kt:1211`, `Rewards.kt:170`, `Meals.kt:76` (**divergence** — meal edit gated on `Create`; web correctly uses `Update`), `Meals.kt:77`. Proposed fix (extends ADR-0031, needs an ADR update): add sub-verb rows for the role-only halves so clients stop proxying: - the Admin|Member manager bucket behind `RequireItemManager` (replaces the `ItemService/Delete` proxy on three surfaces), - `Claim.other` for admin-claims-on-behalf, - the admin half of non-self `ExportUserData`. Then re-gate every proxy site on the verb it actually performs.

nalum added the

labels

2026-08-18 10:45:26 +00:00

nalum referenced this issue

2026-08-18 11:22:44 +00:00

Order of work for the open backlog (#107–#136) #137

nalum referenced this issue

2026-08-18 12:25:30 +00:00