You’re viewing Paradaux’s public workspaceSign in to vote and comment Get taskl.ie for your team

PAR-185

Loading issues

PAR-185 · Enforce RBAC server-side at the REST API + service layer · Paradaux · taskl.ie

PAR-185

Enforce RBAC server-side at the REST API + service layer

Today the backend authorizes nothing — security/ActorContext.java and api/ApiAuthFilter.java explicitly defer policy to the UI, so any holder of a valid workspace API key (or the static service key) can perform every admin write, demote an owner, or remove the last owner.

Fix: enforce permissions server-side, keyed off the resolved actor's role in the active tenant (TenantContext + the new role model).

Resolve the acting member's permissions from tenant_member.role_id (after the role-model migration).
Add a permission check at the service layer (WorkspaceAdminService, task mutations, releases, integrations) — e.g. requirePermission(MEMBER_MANAGE) before setMemberRole/removeMember; ISSUE_DELETE before delete; SETTINGS_MANAGE before status/label/role edits.
Last-owner / owner-immutability guard in setMemberRole/removeMember.
Distinguish the static service key (full trust, internal) from per-workspace keys (subject to RBAC).

Acceptance: a viewer/contributor key cannot perform manage-level writes; a non-owner cannot demote/remove an owner; the last owner cannot be removed. Service-layer tests per permission.

Activity

tesks created the issue Jun 15
tesks set status to In Progress Jun 15
tesksJun 15
Partial — admin surface done on develop (commit 25680a9). PermissionService resolves the actor's grants from ActorContext + TenantContext; require(...) throws ForbiddenException → 403. Enforced across WorkspaceAdminService: member.manage on add/set-role/remove member, settings.manage on labels/teams/projects/statuses. Owner protections: only an owner can grant the owner role or modify/remove another owner; last owner can't be demoted/removed. 7 RBAC tests added.

Remaining for this issue:
- Enforce on the other controllers/services: IssueApiController (issue.create/update/delete), ReleaseApiController (release.manage), IntegrationApiController + GitHub repo-link config (settings.manage), VoteService (stays open to any signed-in user by design).
- Decide how the global Keycloak staff role interacts: backend now denies non-members, so a staff user who isn't a workspace member will get 403 on managed writes (previously the UI let staff act on any workspace). Either add staff as members or add an explicit backend break-glass — coordinate with PAR-187.
tesks set status to Pending Release Jun 15
tesksJun 15
Done on develop (commit c7d4aa0). Enforcement now spans the whole REST surface: IssueApiController (issue.create/update/comment; delete → soft-archive on issue.delete), ReleaseApiController + IntegrationApiController (settings.manage), in addition to the admin surface from 25680a9. Staff decision implemented: a forwarded X-Actor-Staff actor resolves to admin-equivalent permissions in any workspace (logged), minus the owner-only powers (issue.destroy / workspace.manage). 108 tests green.
ParadauxIO linked a commit: Commit 25680a9 — Add configurable per-workspace RBAC + enforce it on the admin surface (PAR-184, PAR-185) Jun 16
ParadauxIO linked a commit: Commit c7d4aa0 — Enforce RBAC on the REST + MCP surfaces; staff break-glass; soft-archive (PAR-185, PAR-186) Jun 16
tesksJun 16
Verified LIVE. perms.require(...) enforced across every mutating surface — WorkspaceAdminService (member/role/settings/team/project/state/sprint), IssueApiController (create/update/move/reorder/delete→archive/comment), ReleaseApiController (cut/addIssue/removeIssue/freeze → settings.manage), IntegrationApiController (guild/keys → settings.manage), WorkspaceSettingsService. Last-owner guard + owner-immutability present; static key = full trust, per-workspace keys scoped to role. No unguarded mutating endpoint found. Acceptance met.
tesks set status to Done Jun 16
ParadauxIO linked a commit: Commit 25680a9 — Add configurable per-workspace RBAC + enforce it on the admin surface (PAR-184, PAR-185) Oct 13
ParadauxIO linked a commit: Commit c7d4aa0 — Enforce RBAC on the REST + MCP surfaces; staff break-glass; soft-archive (PAR-185, PAR-186) Oct 13

Sign in to comment

Join the conversation, react to comments and vote on this issue.