nick-doc/Issues/ISSUE-086-frontend-paymentdetailsview-status-dropdown-exposed-to-all-use.md at cc6395f75b79cbcf7a2944a476aec5f76a68cb80

Files

Siavash Sameni dceaf82934 audit: 2026-05-30 full-codebase audit — report, issues, docs, runbooks

Full-codebase-audit 2026-05-30 outputs:
- Audit report: 09 - Audits/Full Codebase Audit - 2026-05-30.md
- 81 issue files ISSUE-055..135 (decisions + 1 skipped no-brainer).
- Scanner docs from scratch (was zero): architecture, data model, API ref, payment
  flow, operations runbook + repo README.
- Doc-sync updates across API reference, data models, flows, design system.
- Secret Rotation Runbook (08 - Operations) for the exposed credentials.
- Reusable workflow guide (07 - Development) + .claude/workflows/full-codebase-audit.js.

Issues remain status:open intentionally — the code fixes are uncommitted-then-committed
working-tree changes per repo and aren't "resolved" until merged/deployed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-05-30 18:48:04 +04:00

1.4 KiB

Raw Blame History

issue, title, severity, domain, labels, status, created, source

issue

title

severity

domain

labels

status

created

source

086

Frontend: PaymentDetailsView status dropdown exposed to all users

medium

Payment

security

frontend

authorization

open

2026-05-30

Full Codebase Audit 2026-05-30

Severity: medium Domain: Payment Labels: security, frontend, authorization

Description

src/sections/payment/view/payment-details-view.tsx:312 renders a status-change dropdown without an isAdmin check. PaymentDetailsCard already gates this correctly with isAdmin, but the view-level dropdown bypasses that check, allowing any authenticated user to attempt a status change from the UI.

Options

Wrap the status TextField in an isAdmin check mirroring PaymentDetailsCard.
Hide the control for non-admins and rely on backend role enforcement too.
Move status changes to an admin-only view.

Recommendation

Gate the control behind isAdmin (as PaymentDetailsCard already does) AND ensure backend enforces admin for the underlying route (see ISSUE-062). UI gating alone is insufficient.

Affected Files

frontend/src/sections/payment/view/payment-details-view.tsx:312

1.4 KiB Raw Blame History