Skip to content
This repository was archived by the owner on May 29, 2026. It is now read-only.

fix(cleanup): admin delegation bypass, ORI lifecycle gate, dead try/catch, find() named args (M1-M4)#338

Merged
rubenvdlinde merged 1 commit into
developmentfrom
fix/pass2-cleanup
May 28, 2026
Merged

fix(cleanup): admin delegation bypass, ORI lifecycle gate, dead try/catch, find() named args (M1-M4)#338
rubenvdlinde merged 1 commit into
developmentfrom
fix/pass2-cleanup

Conversation

@rubenvdlinde

Copy link
Copy Markdown
Contributor

Summary

  • M1 DelegationController revoke/expire: add IGroupManager; admins pass null (skip ownership check), non-admins pass callerUid. Admins can now manage any delegation without triggering the principal-ownership error.
  • M2 OriController::show: lifecycle gate changed to null-check — schemas without lifecycle/status fields (votes, persons, etc.) were always returning 404 because empty string != 'published'. Now only blocks when the field is actually present.
  • M3 OriPublicationService::publish: rethrow after logging so VotingService outer catch can attach oriPublicationError to round data. Previously swallowed all exceptions, making the outer catch dead code.
  • M4 Standardize find() to named-arg pattern (id/register/schema) in DelegationService, TaskService, MotionCoauthorService. Removes redundant setRegister/setSchema prefix calls.
  • L2 Already resolved by PR A (AgendaController requireChairOrAdmin no longer uses findAll with register/schema in filters[]).
  • L3 Already present in MailReplyHandler::signMailEntry (@SPEC annotation exists at line 167).
  • Fix Application.php DI: add groupManager to DelegationController wiring.

Test plan

  • PHPCS: clean (0 errors)
  • PHPStan: clean (0 errors)
  • Admin can revoke/expire any delegation (no 403)
  • Non-admin can only revoke/expire their own delegation
  • ORI /votes/{id} returns 200 for valid vote objects (not 404)
  • VotingService closeVotingRound attaches oriPublicationError when ORI publish fails
  • DelegationService/TaskService/MotionCoauthorService find calls use named-arg form

…atch, find() named args (M1-M4/L2)

- M1: DelegationController revoke/expire — add IGroupManager; pass null
  (skip ownership check) for admins, callerUid for non-admins, enabling
  admins to revoke/expire any delegation without ownership error
- M2: OriController::show — lifecycle gate now uses null-check so schemas
  without a lifecycle/status field (votes, persons, etc.) pass through
  instead of returning 404 on every request
- M3: OriPublicationService::publish — rethrow \Throwable after logging
  so the outer VotingService catch can attach oriPublicationError to the
  round data (previously swallowed all exceptions, making outer catch dead)
- M4: Standardize find() to named-arg pattern in DelegationService,
  TaskService, MotionCoauthorService — remove setRegister/setSchema prefix
- L2: already resolved by PR A (AgendaController requireChairOrAdmin no
  longer uses findAll with register/schema in filters[])
- L3: already present in MailReplyHandler::signMailEntry (@SPEC tag exists)
- Fix Application.php DI: add groupManager to DelegationController wiring
@rubenvdlinde rubenvdlinde merged commit eb4fad9 into development May 28, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant