Defense-in-depth: render-path requireCapForAction throw should render graceful acceso-denegado, not 500 + admin error-email storm (generic error-boundary / convert render-path cap checks to redirect variant). Surfaced by PLUTO-43 (dead-fetch was the trigger; this guards the class).

Sub-tickets

Questions

Activity

• wi-cli-venus created · 2026-06-12
• wi-cli-venus note · 2026-06-12
  Scoping nuance from audit-pluto (PLUTO-43 concurrence): a direct grep for render-path THROWING guard imports comes back ~empty and is MISLEADING. The real risk class is a render/page awaiting an ACTION that INTERNALLY throws a cap-guard (withCap/requireCapForAction) — exactly the PLUTO-43 dead-fetch bug. PLUTO-44 sweep must trace render-path call sites for imported server actions that wrap withCap/requireCapForAction, NOT direct guard imports. Fix shape: render-path cap-throw -> graceful acceso-denegado, not 500+admin-email.
• wi-cli-venus assigned · 2w ago
  coder-pluto-cc
• wi-cli-venus statusChanged · 2w ago
  coder-pluto-cc: PM go 2026-08-01. Class-A (auth gate + email-send path) — audit design-ping opened with audit-pluto-ca (coder-pluto-cc-msaf9x3t3cve) before implementing, per push-to-done. Measured first: ZERO render-path call sites of the throwing guards in src/app today, so this is prophylactic class-hardening, not a live bug. Proposed shape: (A) onRequestError skips the error-tier row + operator alert for the two denial messages, since the guard already wrote its info/authz row — mirrors action.ts classify()'s tier-null branch on the render path classify() never sees; (B) keep requireCap (redirect) as the render-path guard + a .gitpush-pre.sh lint banning *ForAction( in src/app page/layout files. Note: a fix in src/app/error.tsx is dead code — Next digests RSC messages in prod, so client-side message classification is a guaranteed false negative.
• wi-cli-venus note · 2w ago
  coder-pluto-cc 2026-08-01 — CORRECTION to the design-ping framing: this is NOT purely prophylactic. src/app has zero render-path call sites of the throwing guards, but lookup-actions.ts calls requireAuthForRead() in exports that run DURING RENDER of /practicas/[id] and /mi-cursada/[id] (its own header documents that placement). A session that dies mid-render therefore throws NO_AUTENTICADO on the render path today = 500 + operator alert email. Rare, not hypothetical. Audit (audit-pluto-ca-msafg4bjtul9) confirmed no split needed; recording the honest priority here rather than leaving the softer 'prophylactic' claim standing as the WI's evidence.
• wi-cli-venus completed · 2w ago
  Render-path auth/cap denial (requireCapForAction throw) now maps to graceful acceso-denegado instead of 500 + admin error-email storm. Typed AuthDenialError (brand-based, fails open across Next bundles), leaf module, gitpush-pre lint bans throwing guards in page/layout, +10 tests. Class-A: audit PASS pre-push, SHA 7184bce v2.22.53, prod READY, live version-match, 0 runtime errors post-deploy.