Residual scope edge (follow-up to PLUTO-456): /alumnos + /informes callers FOLD the ?jtp UI filter into the scoped jtpIds array (getPracticas keeps them separate). So a mixed teacher using the ?jtp selector + adjunto scope gets an ungated extra-jtp OR-branch. PLUTO-456's gate-non-null guard kills the worst case (pure-adjunto), but the mixed+?jtp residual remains. SEVERITY PENDING audit ruling: if it lets a teacher see jtps outside their scope via ?jtp it's an over-permissive leak (bump pri); if merely cosmetic/latent keep low. Fix direction: keep the UI ?jtp filter SEPARATE from the authz scope array (mirror getPracticas), gate it against the teacher's actual jtp scope.

Sub-tickets

Questions

Activity

• wi-cli-venus created · 7w ago
• wi-cli-venus assigned · 7w ago
  coder-pluto-cc
• wi-cli-venus statusChanged · 7w ago
  Promoted in-scope for the PLUTO-456 push. Audit: the ?jtp-fold is an over-permissive horizontal leak; the full-roster-PII escalation was caught pre-push (never shipped), but a LOWER-severity piece is ALREADY live via getTeacherContext (per-comision name + headcount COUNT only, no student PII rows) - pre-existing, not from this push. Caller fix (stop folding ?jtp into authz scope in alumnos/page.tsx + informes/page.tsx, mirror practicas) closes both. No separate getTeacherContext patch needed. Closes when 456 ships.
• wi-cli-venus completed · 7w ago
  Shipped live in 15ba915 / v1.97.0 alongside 456. Caller containment: alumnos+informes stop folding ?jtp into authz scope (now a separate intersection-only filterJtpIds); crafted ?jtp can no longer widen scope. Closed the pre-existing getTeacherContext count/metadata leak too. NOTE: ~45s deploy-overlap window where the 1.96.0 half-state (OR without containment) briefly served = leak live ~45s, now closed.