Source of truth
Follow-up from #782. The first-pass security route inventory shows many authorized handlers are token-only at the route layer and rely on module-level ownership or group permission checks.
Scope
- Classify each token-only route in
docs/security-route-inventory.md as user-owned object access, group membership, group edit/admin, admin/core permission, safe self route, or ambiguous/missing control.
- Start with
group, groupCategory, content, fileCatalog, staticSiteGenerator, pin, autoActions, and social import modules.
- Convert ambiguous or missing checks into focused tests and fixes.
- Update
docs/security-review.md and regenerate docs/security-route-inventory.md when route/security notes change.
Verification
npm run security:route-inventory- Targeted tests for any ownership fixes added.
Source of truth
Follow-up from #782. The first-pass security route inventory shows many authorized handlers are token-only at the route layer and rely on module-level ownership or group permission checks.
Scope
docs/security-route-inventory.mdas user-owned object access, group membership, group edit/admin, admin/core permission, safe self route, or ambiguous/missing control.group,groupCategory,content,fileCatalog,staticSiteGenerator,pin,autoActions, and social import modules.docs/security-review.mdand regeneratedocs/security-route-inventory.mdwhen route/security notes change.Verification
npm run security:route-inventory