#2 - Add QA pass H — authorization and abuse - null/Project-Template

null commented

2026-08-17 22:51:04 -05:00

Owner

docs/qa/ClaudeQAPlan.md stops at pass G. Passes A-G contain no case where a caller is not who they claim, does not own what they ask for, or asks too often. Pass B walks the happy path; nothing looks at what B cannot see.

This has already cost this portfolio once: requireCoupleContext in Closer-Couples never checked the caller was in the couple whose data was returned. Authentication was present and correct and proved nothing about ownership.

The organising sentence: authenticated is not the same as owning, and neither is the same as permitted. Login is the front door; every room inside still needs its own lock.

Pass H covers: every authenticated endpoint called logged-out; a list endpoint checked for rows the caller should not see; User A requesting User B's object by id; an admin route opened as an ordinary user; the most expensive endpoint hit repeatedly; the built bundle and localStorage inspected.

Verify: docs/qa/ClaudeQAPlan.md lists pass H with all six cases, and docs/qa/ClaudeQACoverage.md has a row for it.

docs/qa/ClaudeQAPlan.md stops at pass G. Passes A-G contain no case where a caller is not who they claim, does not own what they ask for, or asks too often. Pass B walks the happy path; nothing looks at what B cannot see. This has already cost this portfolio once: `requireCoupleContext` in Closer-Couples never checked the caller was in the couple whose data was returned. Authentication was present and correct and proved nothing about ownership. The organising sentence: **authenticated is not the same as owning, and neither is the same as permitted.** Login is the front door; every room inside still needs its own lock. Pass H covers: every authenticated endpoint called logged-out; a list endpoint checked for rows the caller should not see; User A requesting User B's object by id; an admin route opened as an ordinary user; the most expensive endpoint hit repeatedly; the built bundle and localStorage inspected. Verify: docs/qa/ClaudeQAPlan.md lists pass H with all six cases, and docs/qa/ClaudeQACoverage.md has a row for it.

null added this to the Batch 01 — Production-readiness controls milestone 2026-08-17 22:51:04 -05:00

null added the

P1

label 2026-08-17 22:51:04 -05:00

null referenced this issue from a commit

2026-08-17 22:54:13 -05:00

feat(qa): pass H, authorization and abuse

null closed this issue

2026-08-17 22:54:13 -05:00

Add QA pass H — authorization and abuse #2