- Shipped
- August 15, 2026 at 12:02 AM UTC
- Author
- kamo
- Commit
- 4d326a4
The six PLOS_* rights have a real feature: KamoLOS is a full loan service. Not deletable. But nothing enforces any of them — no rights check anywhere in KamoLOS, and the kamo-internal proxy authenticates the session without checking a right — so any authenticated org member would reach every loan endpoint. It is not currently exposed: kamolos-service exists in the cluster but there is no kamolos-deployment, so the Service has no backing pods. Not an incident; a trap being set. That makes now the cheap moment. Gating today locks nobody out because nobody can reach the module. After it deploys and people service loans, the identical change becomes a seeded migration with a real blast radius. Two things to fix in the same pass: ProxyHmacFilter — which is what makes the X-Org-Id header trustworthy at all — defaults to disabled and is not set in KamoLOS/k8s/deployment.yaml, so LoanController currently trusts a client-supplied org header; and LoanController.get(uid) returns any loan by id with no org check. Stopped short of implementing because gating the proxy needs the member's rights and ksemSessionShared does not expose them — no proxy route gates on a right today. Plumbing rights into the KSEM session read affects every proxy, so it is its own slice rather than something to bolt onto this triage.