- Shipped
- 15 Agosti 2026, 00:13 UTC
- Author
- kamo
- Commit
- f376405
KamoLOS enforces nothing — no rights check anywhere in its source — so this proxy is the authorization boundary for the module, the position denyUnless occupies inside SecurityService. Without it any authenticated org member reaches every loan endpoint. Done NOW because KamoLOS has no deployment and therefore no users: gating today costs nobody access, while the identical change after the module ships is a seeded migration with a real lockout blast radius. The cheap moment is before it goes live. Reads take PLOS_VIEW_PIPELINE; state-changing paths take the right that names the act, so an org can let someone take applications without also letting them fund or deny a loan — the separation the six rights were split for. Unrecognised paths fall through to the WRITE default: a new KamoLOS endpoint arrives locked rather than inheriting read access because nobody updated the table. ksemSessionShared gains rightsFromKsem/ksemHasRight, making this the first proxy route in the app to check a right. It FAILS CLOSED on a session with no rights array — a cookie predating the field is refused, not waved through, or anyone holding an old cookie has a permanent bypass. A test caught a real defect while writing this: String(null) is the truthy string 'null', which survived filter(Boolean) and put a junk name in the rights list. Still outstanding inside KamoLOS for whoever deploys it: LOS_PROXY_HMAC_ENABLED is unset so ProxyHmacFilter is off and LoanController trusts an unsigned X-Org-Id, and LoanController.get(uid) returns any loan with no org check. The proxy gate reduces exposure but substitutes for neither.