Introduced by the merge of #1414 (project visibility eradication / membership-based access control). The SECURITY-GATE: CheckAccess block in getProject (pkg/hub/handlers_projects_core.go) was dropped/reordered during that merge, so createProjectGroup and createProjectMembersGroupAndPolicy currently run before the authorization check rather than after — a write-before-auth anti-pattern. Confirmed still live on current main.
Fix is written, reviewed, and open: fork PR #1391 ("fix(hub): restore SECURITY-GATE CheckAccess in getProject handler"), identical to the already-validated commit 13ac6cf on scion/proj-visibility-dev.
Per ptone: leaving PR#1391 open for now rather than merging immediately — the in-progress authz-foundation-refactor (Policy/RoleBinding unification) may obsolete this code path entirely, and the team on that work shouldn't be distracted with this right now. This issue exists so a future triage/validation sweep catches it and decides whether to merge #1391 as-is or fold the fix into the foundation refactor.
Introduced by the merge of #1414 (project visibility eradication / membership-based access control). The
SECURITY-GATE: CheckAccessblock ingetProject(pkg/hub/handlers_projects_core.go) was dropped/reordered during that merge, socreateProjectGroupandcreateProjectMembersGroupAndPolicycurrently run before the authorization check rather than after — a write-before-auth anti-pattern. Confirmed still live on current main.Fix is written, reviewed, and open: fork PR #1391 ("fix(hub): restore SECURITY-GATE CheckAccess in getProject handler"), identical to the already-validated commit 13ac6cf on scion/proj-visibility-dev.
Per ptone: leaving PR#1391 open for now rather than merging immediately — the in-progress authz-foundation-refactor (Policy/RoleBinding unification) may obsolete this code path entirely, and the team on that work shouldn't be distracted with this right now. This issue exists so a future triage/validation sweep catches it and decides whether to merge #1391 as-is or fold the fix into the foundation refactor.