Apply per-job permissions to manual worker-job requests #68

New Issue

2026-11-05T12:09:30Z

spencerm commented

2026-11-05 12:09:30 +00:00

Priority: medium; documented authorization mismatch.

server/packetstation/api/jobs.py:31 accepts Clerical in any session. The run route (server/packetstation/api/jobs.py:161) then accepts any registered job. A Clerical PIN session can request integrity, AD reconcile and other administrative jobs, not just feed work.

SECURITY/GO-LIVE describe manual integrity requests as Admin/password-session operations. docs/GO-LIVE.md:228. The existing endpoint records requests in the audit; no role-granting exploit is claimed.

Acceptance criteria:

Define an explicit per-job authorization allowlist.
Preserve intended Clerical feed controls while restricting administrative maintenance jobs to the intended role and session type.
Apply equivalent checks to every route/helper that can enqueue those jobs.
Add a role/session/job matrix test and align SECURITY/GO-LIVE documentation with the approved policy.

Validation: code-path and documentation review; no authenticated DB reproduction. Source: GLM.

Reviewed revision: 18333600b55b70971877c1a0c72d1d61b6ce9c69. Raised from the November 2026 independent project reviews and parent verification. No production system was tested.

Priority: medium; documented authorization mismatch. [server/packetstation/api/jobs.py:31](https://gt.pescoinc.biz/spencerm/PacketStation/src/commit/18333600b55b70971877c1a0c72d1d61b6ce9c69/server/packetstation/api/jobs.py#L31) accepts Clerical in any session. The run route ([server/packetstation/api/jobs.py:161](https://gt.pescoinc.biz/spencerm/PacketStation/src/commit/18333600b55b70971877c1a0c72d1d61b6ce9c69/server/packetstation/api/jobs.py#L161)) then accepts any registered job. A Clerical PIN session can request integrity, AD reconcile and other administrative jobs, not just feed work. SECURITY/GO-LIVE describe manual integrity requests as Admin/password-session operations. [docs/GO-LIVE.md:228](https://gt.pescoinc.biz/spencerm/PacketStation/src/commit/18333600b55b70971877c1a0c72d1d61b6ce9c69/docs/GO-LIVE.md#L228). The existing endpoint records requests in the audit; no role-granting exploit is claimed. Acceptance criteria: - Define an explicit per-job authorization allowlist. - Preserve intended Clerical feed controls while restricting administrative maintenance jobs to the intended role and session type. - Apply equivalent checks to every route/helper that can enqueue those jobs. - Add a role/session/job matrix test and align SECURITY/GO-LIVE documentation with the approved policy. Validation: code-path and documentation review; no authenticated DB reproduction. Source: GLM. Reviewed revision: `18333600b55b70971877c1a0c72d1d61b6ce9c69`. Raised from the November 2026 independent project reviews and parent verification. No production system was tested.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: spencerm/PacketStation#68