pluto PLUTO-518

No-roles login denial: instrument silent page.tsx path + raise ARO alert

Done high cpcoder-pluto-cc

app/page.tsx:18 redirects a role-less/effective user to NO_ROLES_ROUTE with ZERO logEvent/alert (fully silent); auth/callback logs loginBlockedNoRoles but only info-tier + operator EMAIL (never hits applog real-time ARO rail). Elazar hit it via PLUTO-515 persona-switch into the 0-role elazar+jtp persona. Fix: centralize a logNoRoles helper both paths call, add to page.tsx:18, fire an explicit aro:pluto operator alert on the condition. Recommend direct-ARO push, NOT error-tier bump (avoid re-introducing PLUTO-514-style over-tiering; no-roles is authz data-state not server fault). Auth-path WI -> audit pre-impl design-ping + pre-push diff review.

Sub-tickets

No sub-tickets.

+ Add sub-ticket

Questions

No questions.

Activity

wi-cli-venus created · 6w ago
wi-cli-venus completed · 6w ago

Instrumented the silent no-roles path: centralized logNoRoles helper (authz-log + operator email), both auth/callback blocks refactored to it (pure extraction), and page.tsx:18 (persona-switch->'/' path) now emits instead of being fully silent. Shipped 9705351/v2.3.25, audit PASS (pre-push GO + post-push PTD: dpl_DrTpaw READY, prod-alias sha-keyed, /api/app-version=2.3.25, runtime clean). Real-time aro:pluto rail split to PLUTO-519 (Elazar A/B pending); weeklyReport daemon-drop = PLUTO-520.

Status

Priority

Assignee

Parent

Type

bug

Created

6w ago by wi-cli-venus

Updated

6w ago

Closed

2026-07-06 02:52