PSA/ee/docs/plans/2026-04-22-premium-abac-exhaustive-remediation-sweep/EXHAUSTIVE_SURFACE_INVENTORY.md

Premium ABAC Exhaustive Surface Inventory

• Plan: 2026-04-22-premium-abac-exhaustive-remediation-sweep
• Last updated: 2026-04-22
• Scope lineage:
  • ee/docs/plans/2026-04-21-premium-abac-authorization-kernel/
  • ee/docs/plans/2026-04-22-premium-abac-remediation/

Semantics Legend

• RBAC ∩ Kernel ∩ Bundle: action requires RBAC and runtime kernel narrowing with bundle overlays.
• Structural Inheritance: child record inherits already-authorized parent resource.
• Linked Intersection: linked child payload must satisfy parent auth and child-resource auth.

Surface Matrix

Domain	File / Surface	Chosen Semantics	Status	Validation
Bundle lifecycle	server/src/lib/authorization/bundles/service.ts draft creation/publish	RBAC ∩ Kernel ∩ Bundle lifecycle invariants	Fixed	T001-T006, F039
Bundle lifecycle	ee/server/src/lib/actions/auth/authorizationBundleActions.ts draft/write/publish/archive	Transactional stale-state safety + assignment governance	Fixed	T001-T006, F039
Bundle lifecycle	lifecycle uniqueness migration preflight	Fail-loud duplicate-row detection + repair guidance	Fixed	T005, F039
Quotes	packages/billing/src/actions/quoteActions.ts reads/mutations/items/conversion	RBAC ∩ Kernel ∩ Bundle for quote + item integrity	Fixed	T007-T010, F040
Documents	packages/documents/src/actions/documentActions.ts read/mutation/count/folder	RBAC ∩ Kernel ∩ Bundle with authorized count semantics	Fixed	T011-T014, F041
Documents	URL routes: download/preview/thumbnail/view	Kernel-authorized document lookup before URL/path response	Fixed	T011, F041
Documents	content/block-content actions	Parent-document authorization required for R/W/D	Fixed	T013, F041
Assets	packages/assets/src/actions/assetActions.ts list/read/summary	RBAC ∩ Kernel ∩ Bundle (authorized totals + per-asset checks)	Fixed	T015-T016, F042
Assets	maintenance/history/relationships/entity lists/client summaries	Parent asset authorization on all read surfaces	Fixed	T016, F024
Assets	update/delete/association/relationship/maintenance mutations	Parent asset authorization + integrity checks	Fixed	T017, F025
Assets	getAssetDetailBundle linked tickets/documents	Structural Inheritance + Linked Intersection	Fixed	T018, F026
Projects	packages/projects/src/actions/projectActions.ts phase/detail/status/tree/count surfaces	Parent project authorization for read/update/delete	Fixed	T019, F027
Project tasks	packages/projects/src/actions/projectTaskActions.ts task/checklist/dependency/resource/ticket-link	Reusable parent-project gating via shared helpers	Fixed	T020, F028-F029
Project statuses	packages/projects/src/actions/projectTaskStatusActions.ts mappings/phase status flows	Parent project gating + zero-check count closure	Fixed	T021, F030
Project aggregates	getPhaseTaskCounts, getProjectTaskData, getStatusMappingTaskCount	Authorized-project-only cardinalities	Fixed	T022, F031
Cross-project ops	task move/duplicate/link flows	Authorize source + target project contexts	Fixed	T023, F032
Project linked tickets	ticket-link payload returns	Linked Intersection with ticket-resource auth	Fixed	F033, project contract test
Time/delegation	packages/scheduling/src/actions/timeEntryDelegationAuth.ts	time_entry kernel checks + not-self-approver mutation guard	Re-audited/fixed	T024, scheduling auth tests
Time/delegation	packages/scheduling/src/actions/timeSheetActions.ts comments/request-changes	Delegation checks required for non-owner approver actions	Re-audited/fixed	T024, timeDelegationSweep.contract.test.ts
Non-API entry points	file/preview/composition routes using hardened actions	Inherit hardened action semantics; no parallel bypass path found in audited set	Re-audited	F035 rationale + route sampling in scratchpad
CE/EE seams	ee/server/src/lib/authorization/kernel.ts + bundle actions + shared kernel providers	CE and EE both resolve runtime bundle narrowing via shared kernel contracts	Re-audited	F036, kernel seam contract references

Re-Audit Notes

F034 — Time / Delegation

• Confirmed time_entry resource key remains canonical in delegation kernel flows.
• Closed delegation gap in requestChangesForTimeSheet and non-owner comment path by requiring assertCanActOnBehalf(...).
• Confirmed approval mutation guard (not self approver) remains enforced in kernel mutation evaluation.

F035 — Non-API Entry Points

Audited representative non-API or composition surfaces that fan into hardened actions:

• Document URL routes in server/src/app/api/documents/... call hardened document authorization actions.
• Asset summary/maintenance/history/relationship routes under server/src/app/api/v1/assets/... call hardened asset actions.
• Project routes under server/src/app/api/v1/projects/... call hardened project/task actions.
• Quote routes under server/src/app/api/v1/quotes/... call hardened quote actions.

No additional bypass-only path was identified in the audited set.

F036 — CE/EE Helper Seams

Audited CE/EE runtime seam usage:

• ee/server/src/lib/authorization/kernel.ts
• ee/server/src/lib/actions/auth/authorizationBundleActions.ts
• Shared kernel provider usage in billing/documents/assets/projects/scheduling actions.

All audited seams continue to converge on shared kernel + bundle-provider runtime semantics; no new divergent shadow model was introduced in this sweep.

Validation Index

• Lifecycle: T001-T006
• Quotes: T007-T010
• Documents: T011-T014
• Assets: T015-T018
• Projects: T019-T023
• Time/delegation re-audit: T024
• Close-out artifact contract: T025