23060261c7
Some checks failed
Architecture Governance / architecture (push) Has been cancelled
core/permissions (SessionPermissions/AuditEvent models, gateway/token, requiresScope() CanActivateFn) against docs/backend/ TRACK-S-SECURITY-RBAC-CONTRACT.md §1-3. PermissionLocalGateway grants PLATFORM_OWNER/'*' unconditionally - this matches TODAY'S REAL behavior (GAPS-AND-IMPROVEMENTS.md: admin role model is decorative, every authenticated admin has full access) rather than faking enforcement that doesn't exist. requiresScope() is correspondingly a no-op against the mock, by design - it must not create a false sense of security before a real backend exists. New features/admin/audit (Audit & Security nav section, missing from admin nav today) - facade + page, empty state until real audit events exist. Scope: deliberately NOT retrofitting requiresScope() onto the 14 existing live admin routes in this pass - a blanket guard rollout risks locking an admin out without warning and needs its own verified pass, not a bundled change alongside nine other phases. This is the single most serious security gap this session's audit found; closing it for real is Track S's own dedicated follow-up once a real backend exists to enforce against. This closes out the full "do all phases" push: 10 phases + 2 tracks, each with a real mock-gateway-backed swappable seam, several with genuinely new backoffice UI. Every core/* module here binds via the same DI-token pattern established for the 9 admin domains at the start of this session - a real backend is a token swap per module, not a rewrite. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>