T6A Alternate Path Inventory¶
Inventory of non-canonical or duplicate Admissions/credential paths. None of these were removed in this tranche (Phase 2 blocked).
| ID | Path | Auth | Why it is alternate | Disposition | DEC / contract |
|---|---|---|---|---|---|
| ALT-001 | /api/SPMB/account/register in spmb_account_api.py |
public |
Calls SPMBApiController.register_account (caller-supplied password + OTP). |
PRODUCT_DECISION_REQUIRED | DEC-014 |
| ALT-002 | /api/SPMB/account/register in spmb_lifecycle_api.py |
none |
Second decorator on the same path. Email-links existing parent, skips verification, no DEC-014 temp secret. Loaded after ALT-001 (controllers/__init__.py). |
LEGACY_REMOVE | DEC-014 item 15 |
| ALT-003 | Native /web signup / reset |
Odoo | DEC-014 rejects native Odoo as customer lifecycle. | EXPLICITLY_EXCLUDED_FAIL_CLOSED | DEC-014 |
| ALT-004 | /my/admissions, /my/admission/<id>, documents, upload (portal.py) |
user website |
Parallel portal lifecycle beside /spmb/*. |
LEGACY_REMOVE | DEC-014 / W03 canonical UI |
| ALT-005 | Pathless @http.route(type='json', auth='user') in spmb_applicants_api.py and spmb_complaints_ranking_api.py |
user JSON | Callable by method name; not an exact public/protected path. | LEGACY_REMOVE | STAB-013 / GAP-01 |
| ALT-006 | /admin-staff/admissions/*, /principal/admissions/*, /vice-principal/*/admissions/* |
role shells | Duplicate staff shells of /admin/spmb/*. |
T6A_SUPPORTED aliases pending UIA contract | STAB-041 |
| ALT-007 | /admin/spmb/ranking route live while launcher item commented |
staff | Hidden menu is not authorization. | PRODUCT_DECISION_REQUIRED | CTRL-005 |
| ALT-008 | /api/SPMB/public/ prefix allowlist |
public | Children inherit public access (/api/SPMB/public/anything-new → True). |
PRODUCT_DECISION_REQUIRED | exact allowlist rule |
| ALT-009 | /api/SPMB/ protected prefix |
user | Broad staff fallback admissions.dashboard.view for unmatched SPMB paths. |
PRODUCT_DECISION_REQUIRED | DEC-003 |
| ALT-010 | Payment/invoice/formulir/discount APIs inside scola_admission |
user | Fees behavior without fees entitlement/module. | BRIDGE_ONLY / fail-closed in base | item 14 |
| ALT-011 | /api/SPMB/my/test-schedules and /my/test-results in base spmb_api.py |
user | Assessment routes kept in base “so overlay absence does not break.” | PRODUCT_DECISION_REQUIRED | item 14 |
| ALT-012 | scola_admission_fees_bridge auto_install=True |
install | Bridge appears whenever both parents exist, without a SKU decision. | PRODUCT_DECISION_REQUIRED | STAB-024 |
| ALT-013 | Foundation /api/v1/foundation/admission/* |
user + sudo search | Separate product; sudo list. | BRIDGE_ONLY | non-goal |
| ALT-014 | Complaint models/APIs/menus inside scola_admission |
user | W17 excluded from T6A and RC1. | EXPLICITLY_EXCLUDED_FAIL_CLOSED | W17 ledger |
| ALT-015 | Per-record ir.cron.sudo().create archival |
superuser cron | Alternate recovery/cleanup vs signed retention. | PRODUCT_DECISION_REQUIRED | item 9 |
| ALT-016 | cron_data.xml not listed in __manifest__.py |
— | Dead/unloaded cron definitions beside live cron_announcement.xml. |
INTERNAL | — |
| ALT-017 | Core smoke SM-T1-001A hits /admin-staff/admissions/dashboard |
e2e | Core smoke contains Admissions business navigation. | LEGACY_REMOVE from Core smoke | QG-14 |
| ALT-018 | tests/e2e/package/adm_topology_smoke.spec.ts |
test | Placeholder expect("SC-ADM").toBe("SC-ADM"). |
not PASS | PKG-ADM-W03 |
| ALT-019 | /web/dataset / call_kw on admission models |
ACL | Direct RPC may bypass Scola API method/action policy. | PRODUCT_DECISION_REQUIRED | STAB-013 |
| ALT-020 | Public /api/SPMB/status by application number |
public | Possible existence oracle. | PRODUCT_DECISION_REQUIRED | item 12 |
Credential collision (DEC-014)¶
There is not one canonical applicant credential lifecycle.
- Account API: caller-chosen password, OTP email,
group_scola_pendaftar. - Lifecycle API: link-by-email to parent/portal user,
state=verified, siblings PII in the public response. - Native website portal upload/list.
- OpenEduCat/Odoo user create via elevated env.
DEC-014 chosen contract is server-generated temporary secret or purpose-bound token, must_change, anti-enumeration, no native customer lifecycle. Current Admissions code does not implement that contract.