Lewati ke isi

T0-A.1 Result — Platform Authorization Closure

Item Value
Mode Server development
Workspace /home/scola/odoo
Scope AUTH-004 completeness/fail-closed; method/action resolver foundation; Core mutation sanity; inventory dimensions; active-role concurrency decision; QC
Out of scope T0-B Golden Tenant; W01/W02/W05; nav redesign; optional-domain capability migration
Docs read development-guide.md, workspace-governance.md, architecture-api.md, T0-A-*, 04/08/09/10 release-readiness
Completed (UTC) 2026-08-08

Exact FE/BE tree state

Repo Branch Base HEAD (unchanged) Working tree
scola-fe-v2 develop b48ca63859d3d822f22572dc76a08afbe4f2f653 dirty — T0-A + T0-A.1 ready to commit
custom_addons_scola/gcgscola main 2ff6ac7cb41810bbc3b66821cdad004b52d1658a dirty — T0-A + T0-A.1 ready to commit

Commit SHAs (reconciled T0-B1 preflight):

Repo Branch SHA
FE develop d46fea0adcc9f08d54d716f082d82a8b79f5bbe7
BE main 50e904e2a12c238d1d78199a1325af85b8f1a134

Earlier draft text claiming “no commit was created” is obsolete after the explicit commit/push of T0-A/T0-A.1.

Unrelated exclude: docs/recon/template_upload_siswa_SD REJIS Kelas 1.xlsx.

Files changed (T0-A + T0-A.1 logical checkpoint)

Frontend

  • docs/release-readiness/04-authorization-readiness.md
  • docs/release-readiness/08-stabilization-backlog.md
  • docs/release-readiness/execution/ (T0-A + T0-A.1 artifacts)
  • src/access/accessContract.js
  • src/access/apiRouteAccessRegistry.js (contract v5, public allowlist, method/action resolve)
  • src/config/capabilityFragments/{peoplePortal,communication}Capabilities.js
  • src/config/roleFragments/*.js (users.attachments.create; pendaftar excluded)
  • src/stores/auth.store.js
  • tests/unit/access/feBackendApiRouteAccessParity.spec.js

Backend

  • scola_core/controllers/auth.py
  • scola_core/controllers/core_reference_api.py
  • scola_core/models/ir_http.py (fail-closed + method/action)
  • scola_core/services/auth_capabilities.py (users.attachments.create)
  • scola_core/services/mail_tracking_access.py (T0-A)
  • scola_core/tests/test_* (active-role, auth capabilities/payload, mail-tracking)
  • scola_platform_support/api_route_access.py (v5 allowlists, method/action, classify)
  • scola_platform_support/api_route_surface.py (new extractor)
  • scola_platform_support/tests/test_api_route_access_unit.py
  • scola_platform_support/tests/test_api_route_auth004_unit.py (new)
  • scripts/modular/api_route_surface_coverage_check.py (new CI gate)

Route extraction totals

Metric Count
Extracted /api/* controller routes 1712
PROTECTED_REGISTERED 1675
PUBLIC_EXPLICIT 34
INTERNAL_NOT_USER_FACING 3
LEGACY_OR_DISABLED 0
UNREGISTERED_PROTECTED_BLOCKER 0
Registry rule rows 427
Public allowlist entries 16
Internal allowlist entries 5

Full report: T0-A1-route-coverage.md.

Core mutation audit summary

Classification Items
CORRECT_ATOMIC_CAPABILITY /api/v1/core/attachments/create → users.attachments.create (fixed)
TRANSITIONAL_MUTATION_CAPABILITY change-password, switch-role, notification-config/save, profile path-level
CONTROLLER_HAS_STRONGER_DOMAIN_GUARD mail-tracking list; attachment model allowlist (secondary)
BLOCKER_BEFORE_T0_B (product use) /api/complaint* registered but capability not granted (STAB-001 containment)
DEFER_TO_NAMED_DOMAIN_TRANCHE optional domains (not migrated)

Detail: T0-A1-core-mutation-audit.md.

QC results (static/unit — no runtime PASS)

Check Result
test_active_role_enforcement_unit.py PASS (12)
test_auth_capabilities_unit.py PASS (73)
test_auth_payload_contract_unit.py PASS (6)
test_mail_tracking_access_unit.py PASS (10)
test_api_route_access_unit.py PASS (53)
test_api_route_auth004_unit.py PASS (20)
api_route_surface_coverage_check.py PASS (0 blockers)
validate_api_route_access_registry() PASS (0 issues)
FE/BE registry parity vitest PASS (5)
check:capability-diff PASS
lint:diff PASS (no JS/Vue lint delta issues)
type-check PASS
Relevant py_compile PASS

No required test skipped. Runtime-only cases remain pending.

PASS / FAIL / PENDING counts

Bucket Count / notes
PASS (static/unit) All listed QC suites above
FAIL 0
PENDING T0-B RUNTIME CERTIFICATION STAB-005/007/008 acceptance; AUTH-004 live denial crawl; AUTH-014; Golden Tenant multi-session / active-role matrix

STAB / AUTH status deltas

ID After T0-A After T0-A.1
STAB-005 Code fixed, runtime pending unchanged (not Closed)
STAB-007 Code fixed, runtime pending unchanged; concurrency decision OPEN → entry gate
STAB-008 Code fixed, runtime pending strengthened (method/action + extractor CI); still runtime pending / not Closed
AUTH-001 Code fixed, runtime pending unchanged (+ session decision gate)
AUTH-003 Code fixed, runtime pending method/action foundation added; still runtime pending
AUTH-004 Partial Code fixed, runtime verification pending
AUTH-002 Open Open (platform capable; domain migration deferred)

Remaining risks (adversarial)

  1. Method confusion: legacy path-only resolve still matches unconstrained rules; constrained rules win when method/action supplied. Callers must pass method for disambiguation on dual-method families.
  2. Read→mutate: Core attachment create fixed; many domain /save still transitional .view / .manage — deferred, not falsely closed.
  3. Active-role leakage: user-global scola_role last-write-wins across sessions — documented; not silently “fixed.”
  4. Stale FE authority: FE cache can lag; BE remains authoritative.
  5. Cross-company: not certified here (AUTH-005).
  6. Raw RPC / controller bypass: framework/non-enforcement namespaces remain OUT_OF_SCOPE by design; enforcement prefixes are explicit.
  7. False-green coverage: denominator is full extracted /api/* controllers (1712), not shrunk; classification never treats missing registry as public.

T0-B entry requirements

  1. Golden Tenant fixtures + runtime matrix for STAB-005/007/008.
  2. Live crawl: unregistered protected fixture denied; public login/session/logout per contract.
  3. Honor T0-A1-active-role-session-decision.md: test interim A unless DEC closes on B.
  4. Do not treat registry presence as scope/correctness proof.
  5. Do not start optional-domain migrations inside T0-B auth certification unless separately scoped.

Checkpoint readiness (no commit created)

Required commit boundary

FE → develop (exclude xlsx recon):

docs/release-readiness/**
src/access/**
src/config/capabilityFragments/**
src/config/roleFragments/**
src/stores/auth.store.js
tests/unit/access/feBackendApiRouteAccessParity.spec.js

Suggested message: fix(auth): T0-A/T0-A.1 platform authorization closure

BE → main:

scola_core/controllers/auth.py
scola_core/controllers/core_reference_api.py
scola_core/models/ir_http.py
scola_core/services/auth_capabilities.py
scola_core/services/mail_tracking_access.py
scola_core/tests/test_active_role_enforcement_unit.py
scola_core/tests/test_auth_capabilities_unit.py
scola_core/tests/test_auth_payload_contract_unit.py
scola_core/tests/test_mail_tracking_access_unit.py
scola_platform_support/api_route_access.py
scola_platform_support/api_route_surface.py
scola_platform_support/tests/test_api_route_access_unit.py
scola_platform_support/tests/test_api_route_auth004_unit.py
scripts/modular/api_route_surface_coverage_check.py

Suggested message: fix(auth): T0-A/T0-A.1 fail-closed routes and method-aware registry

After commit, record SHAs here:

Repo Commit SHA
FE 59bdbf92db2da8a6c7c766727a720fb4ca2fa546
BE pending user-approved commit

T0-A.1 exit checklist

Exit criterion Met?
Zero unknown user-facing protected routes silently bypass capability policy Yes (fail-closed + 0 blockers)
Extractor vs registry gap machine-visible and CI-gated Yes
Resolver supports method/action-aware rules Yes (v5; backward-compatible path rules)
Obvious Core mutation/read contradictions fixed or deferred/blocked Yes
Active-role concurrency decision/gate documented Yes (OPEN → B recommended; interim A)
T0-A security suites green Yes
Runtime-only evidence explicitly pending Yes
STAB-005/007/008 fully Closed No — correctly remain runtime-pending