15 lines
1002 B
JSON
15 lines
1002 B
JSON
{
|
|
"feature_id": "F-154",
|
|
"agent": "security",
|
|
"stage": "security_gate",
|
|
"verdict": "APPROVED",
|
|
"summary": "Backend-only role filtering with code-constant literals (role = 'customer' / role <> 'customer'); user input (q, role) stays parameterized. No new routes, RBAC, or auth changes. Single-user endpoints unchanged.",
|
|
"checks": [
|
|
{"item": "No new routes/RBAC/auth", "ok": true, "evidence": "GET /users and GET /admin/users signatures unchanged; requireRole(authenticate) intact; only WHERE clause literal added"},
|
|
{"item": "Injection safety", "ok": true, "evidence": "role compared to code constant (not user input); q and ?role parameterized as $N; param indices unchanged"},
|
|
{"item": "IDOR", "ok": true, "evidence": "single-user GET /users/:id unchanged (owner-or-admin)"},
|
|
{"item": "Pre-existing boundary note", "ok": true, "evidence": "git diff excludes log-broadcaster import in security.routes.ts; R1 is pre-existing, not introduced by F-154"}
|
|
],
|
|
"issues": []
|
|
}
|