T6A Authorization Traceability (as-is)¶
Not an implementation of STAB-013. This records the current authority map so Phase 3 can start after the product gate.
Entitlement vs install¶
| Layer | Mechanism | Current |
|---|---|---|
| SKU | SC-ADM → flag scola_admission (platform_entitlements.py) |
Golden OFF; Dev installed+OFF; Demo installed+ON |
| API registry | SPMB prefixes require scola_admission + a capability |
/api/SPMB/ fallback capability is admissions.dashboard.view |
| FE launcher | admissionsApp.featureFlag = scola_admission |
hiding is not backend auth |
| Installed-but-unentitled | Dev runtime is this state | not probed this tranche (no behavioral tests) |
Capability vocabulary (FE)¶
From admissionsCapabilities.js: view/create/edit registration, dashboard, period, schedule, ranking, result, config views, SIC, complaints, CBT manage, DTKS.
Missing atomic verbs for STAB-013: configure vs view, delete, verify, decide, enroll, reopen, withdraw.
Config API VIEW_CAPABILITIES is used for list and save/delete (admission_config_api.py). Technical admin bypasses the check.
Route registry (BE)¶
| Prefix | Flag | Capability | Issue |
|---|---|---|---|
/api/SPMB/account/register exact public |
— | public | Dual controller |
/api/SPMB/public/ prefix |
— | public | child inheritance |
/api/SPMB/registers exact public |
— | public | list is protected (T0F-013) |
/api/SPMB/my/ |
scola_admission |
admissions.portal.view |
most applicant mutations |
/api/SPMB/payment/ |
scola_admission |
admissions.payment.submit |
fees in base module |
/api/SPMB/ |
scola_admission |
admissions.dashboard.view |
staff catch-all |
/api/v1/admissions/config/... |
scola_admission |
per-resource view | save/delete not split |
Acting role vs assigned-role union¶
Not proven for Admissions. Core DEC-003 acting-role work does not automatically cover SPMB controllers. Many staff methods call _check_access(model, 'write') or _sudo_model.
Company / tenant¶
Config uses _user_company_ids(). Staff list/detail/transition and public status/quota tenant isolation are unproven (RT-W03-TEN-01 NOT RUN). Cross-tenant IDs must fail closed with zero mutation once tests run.
Elevation / sudo¶
Broad _sudo_model / .sudo() appears in spmb_api.py, registers/applicants/complaints, payment, config elevated models, foundation list, and enroll_student parent/invoice helpers. New sudo was not added in T6A. Existing sudo remains an S2 residual for Phase 3.
Public methods¶
Public JSON routes declare methods=['POST']. Lifecycle register uses auth='none' vs account auth='public'. CORS * on many portal routes.
Direct RPC¶
No T6A evidence that /web/dataset call_kw on op.admission / config models is denied when Scola API would deny. Required by RT-W03-NEG-01.
Package OFF¶
Golden: module uninstalled + flag false — Core RC1 already treats Admissions as gated/excluded. Dev: module installed + flag false — must expose no internal Admissions authority; not runtime-proven here (T6A-B). Frontend hiding is insufficient.