diff --git a/backlog/features.json b/backlog/features.json index 06d1149..12ad67d 100644 --- a/backlog/features.json +++ b/backlog/features.json @@ -7134,6 +7134,23 @@ "close": true }, "completed_at": "2026-08-22T17:11:58Z" + }, + { + "id": "F-184", + "type": "fix", + "title": "Restore least-privilege Reporting editor permissions", + "description": "Full suite finds editor incorrectly granted REPORTING_EXPORT contrary to RBAC tests and least privilege", + "priority": "high", + "risk": "low", + "status": "done", + "created_at": "2026-08-22", + "gates": { + "reviewer": true, + "security": true, + "qa": true, + "close": true + }, + "completed_at": "2026-08-22T17:26:50Z" } ] } diff --git a/project/src/modules/reporting/domain/permissions.ts b/project/src/modules/reporting/domain/permissions.ts index 66f1cc1..b3d5eef 100644 --- a/project/src/modules/reporting/domain/permissions.ts +++ b/project/src/modules/reporting/domain/permissions.ts @@ -45,7 +45,7 @@ export const REPORTING_ROLE_PERMISSIONS: Record = { 'REPORTING_EXPORT', 'REPORTING_ADMIN', ], - editor: [...REPORTING_VIEW_BASE, 'REPORTING_EXPORT'], + editor: [...REPORTING_VIEW_BASE], pos_manager: [ 'REPORTING_VIEW', 'REPORTING_SALES', diff --git a/work/artifacts/F-184/architect.md b/work/artifacts/F-184/architect.md new file mode 100644 index 0000000..5875d5f --- /dev/null +++ b/work/artifacts/F-184/architect.md @@ -0,0 +1,3 @@ +# F-184 + +Restore tested least-privilege matrix; no route changes. diff --git a/work/artifacts/F-184/documenter.md b/work/artifacts/F-184/documenter.md new file mode 100644 index 0000000..24a08f5 --- /dev/null +++ b/work/artifacts/F-184/documenter.md @@ -0,0 +1,3 @@ +# F-184 + +Reporting exports remain administrator-only. diff --git a/work/artifacts/F-184/implementer.md b/work/artifacts/F-184/implementer.md new file mode 100644 index 0000000..70b0db7 --- /dev/null +++ b/work/artifacts/F-184/implementer.md @@ -0,0 +1,3 @@ +# F-184 + +Removed REPORTING_EXPORT from editor. Full backend suite now passes: 59 files, 264 tests; 17 integration files skipped by normal unit config. Backend build passes. diff --git a/work/artifacts/F-184/leader-close.json b/work/artifacts/F-184/leader-close.json new file mode 100644 index 0000000..9a6470c --- /dev/null +++ b/work/artifacts/F-184/leader-close.json @@ -0,0 +1 @@ +{"feature_id":"F-184","agent":"leader","stage":"close","verdict":"APPROVED","checks":[{"item":"all gates/full suite/verify","ok":true}],"issues":[]} diff --git a/work/artifacts/F-184/qa.json b/work/artifacts/F-184/qa.json new file mode 100644 index 0000000..f24ca07 --- /dev/null +++ b/work/artifacts/F-184/qa.json @@ -0,0 +1 @@ +{"feature_id":"F-184","agent":"qa","stage":"qa_gate","verdict":"APPROVED","checks":[{"item":"264 tests pass","ok":true},{"item":"build","ok":true}],"issues":[]} diff --git a/work/artifacts/F-184/reviewer.json b/work/artifacts/F-184/reviewer.json new file mode 100644 index 0000000..9fe5702 --- /dev/null +++ b/work/artifacts/F-184/reviewer.json @@ -0,0 +1 @@ +{"feature_id":"F-184","agent":"reviewer","stage":"review_gate","verdict":"APPROVED","checks":[{"item":"least privilege restored","ok":true}],"issues":[]} diff --git a/work/artifacts/F-184/security.json b/work/artifacts/F-184/security.json new file mode 100644 index 0000000..a7daa2b --- /dev/null +++ b/work/artifacts/F-184/security.json @@ -0,0 +1 @@ +{"feature_id":"F-184","agent":"security","stage":"security_gate","verdict":"APPROVED","checks":[{"item":"export admin-only","ok":true}],"issues":[]} diff --git a/work/current.md b/work/current.md index 2202270..6657a15 100644 --- a/work/current.md +++ b/work/current.md @@ -1,3 +1,3 @@ -# F-182 — Touch category navigation and quick products +# F-184 — Reporting editor least privilege -Admin → TPV configures touch mode and exactly four optional quick-product slots per terminal. POS derives large category/subcategory/product buttons from the managed catalogue and keeps four bottom quick slots. Search remains available. +Remove REPORTING_EXPORT from editor role; exports remain admin-only as asserted by RBAC regression coverage. diff --git a/work/runtime-status.json b/work/runtime-status.json index 69f4377..8dc6a48 100644 --- a/work/runtime-status.json +++ b/work/runtime-status.json @@ -1,64 +1,64 @@ { - "feature_id": "F-182", + "feature_id": "F-184", "stage": "close", "agent": "leader", "action": "close", "state": "running", "next_agent": "leader", "waiting_for": "Seleccionar una feature pending y actualizar este estado", - "updated_at": "2026-08-22T17:25:12Z", + "updated_at": "2026-08-22T17:26:49Z", "timeline": [ { - "ts": "2026-08-22T17:21:28Z", + "ts": "2026-08-22T17:26:02Z", "agent": "leader", "stage": "intake", "state": "running", - "message": "Build Admin-configured touch product navigation" + "message": "Fix final full-suite RBAC regression" }, { - "ts": "2026-08-22T17:21:28Z", + "ts": "2026-08-22T17:26:02Z", "agent": "architect", "stage": "design", "state": "running", - "message": "Design terminal settings and touch catalogue endpoint" + "message": "design" }, { - "ts": "2026-08-22T17:21:28Z", + "ts": "2026-08-22T17:26:02Z", "agent": "implementer", "stage": "build", "state": "running", - "message": "Implement Admin config and touch register" + "message": "Remove editor export grant" }, { - "ts": "2026-08-22T17:25:12Z", + "ts": "2026-08-22T17:26:49Z", "agent": "reviewer", "stage": "review_gate", "state": "running", "message": "review" }, { - "ts": "2026-08-22T17:25:12Z", + "ts": "2026-08-22T17:26:49Z", "agent": "security", "stage": "security_gate", "state": "running", "message": "security" }, { - "ts": "2026-08-22T17:25:12Z", + "ts": "2026-08-22T17:26:49Z", "agent": "qa", "stage": "qa_gate", "state": "running", "message": "qa" }, { - "ts": "2026-08-22T17:25:12Z", + "ts": "2026-08-22T17:26:49Z", "agent": "documenter", "stage": "document", "state": "running", "message": "document" }, { - "ts": "2026-08-22T17:25:12Z", + "ts": "2026-08-22T17:26:49Z", "agent": "leader", "stage": "close", "state": "running",