dceaf82934
Full-codebase-audit 2026-05-30 outputs: - Audit report: 09 - Audits/Full Codebase Audit - 2026-05-30.md - 81 issue files ISSUE-055..135 (decisions + 1 skipped no-brainer). - Scanner docs from scratch (was zero): architecture, data model, API ref, payment flow, operations runbook + repo README. - Doc-sync updates across API reference, data models, flows, design system. - Secret Rotation Runbook (08 - Operations) for the exposed credentials. - Reusable workflow guide (07 - Development) + .claude/workflows/full-codebase-audit.js. Issues remain status:open intentionally — the code fixes are uncommitted-then-committed working-tree changes per repo and aren't "resolved" until merged/deployed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
1.5 KiB
1.5 KiB
issue, title, severity, domain, labels, status, created, source
| issue | title | severity | domain | labels | status | created | source | |||
|---|---|---|---|---|---|---|---|---|---|---|
| 057 | Frontend admin UI routes lack role-based authorization guard | high | Admin |
|
open | 2026-05-30 | Full Codebase Audit 2026-05-30 |
Frontend admin UI routes lack role-based authorization guard
Severity: high Domain: Admin Labels: security, frontend, authorization
Description
The /dashboard/admin/* route tree has no RoleBasedGuard at the layout level. Any authenticated user who knows the URL can access and interact with admin pages (trezor, payments-awaiting-confirmation, etc.) without any frontend role enforcement.
Options
- Wrap the admin route segment in a single
RoleBasedGuard(admin)at the layout level — minimal surface, one place to maintain. - Add
useRolechecks inside each section view — more granular but repetitive and error-prone. - Server-side redirect in Next.js middleware for
/dashboard/admin/*based on a decoded role claim — strongest but needs role in token/cookie.
Recommendation
Add a RoleBasedGuard(admin) at the admin route-group layout (single chokepoint), and confirm the backend independently enforces admin on every admin API. Defense in depth, low blast radius.
Affected Files
frontend/src/app/dashboard/admin/trezor/page.tsxand all sibling admin pages- Admin route-group layout file
References
- Full Codebase Audit 2026-05-30 — DEC-1