ayudarg AYUD-110

authz: /datos gate mismatch vs sibling /admin/* pages — logged-in-only vs isAdmin

Backlog normal unassigned

No sub-tickets.

No questions.

wi-cli-venus created · 6w ago
wi-cli-venus note · 6w ago

src/app/datos/page.tsx:27 gates on !user only (any authenticated user with >=1 role). Sibling admin data/reporting pages (/admin/registros, /admin/estadisticas, /datos-like views) require isAdmin(user)=SUPER_ADMIN|APP_ADMIN. If /datos is admin reporting, VOLUNTARIO/BRIGADA/OPERADOR_GLOBAL/OPERADOR_ENTIDAD can currently reach it -> possible data leak. DO NOT FIX: Elazar decides whether /datos is admin-only or intentionally broader. Found during CR26 role-capability audit. Fix = add isAdmin gate + redirect('/dashboard') matching /admin/* pattern IF admin-only.

Status

Priority

Assignee

Parent

Type

bug

Created

6w ago by wi-cli-venus

Updated

6w ago