J3vbandClaude Fable 5 a3459e5f80 fix(admin): route admin-panel bans through ModerationService (W1-4) ...

requireBanAuthority (BAN_MEMBERS + role hierarchy) was wired only into
ModerationService.BanUser/UnbanUser — which had zero production callers.
The live path, handlePatchUser, ran a raw UPDATE with no hierarchy check,
so any admin-panel actor could ban an equal- or higher-ranked user,
including the owner. The ban/unban branch now calls the service (dead code
becomes THE code — ban path 1 of 3 consolidated), which also audits as
user_ban/user_unban, keeping the historical audit vocabulary.

Authorization now runs in permission → existence → hierarchy order: an
actor without ban authority sees Forbidden, never NotFound, so the ban
path cannot enumerate user ids. The role+ban transaction is gone — the
ban leg lives in the service, runs first, and a refusal returns before
the role change executes, so a rejected ban never half-applies a PATCH.
MemStore gains honest BanUser/UnbanUser so the matrix is testable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-19 08:41:12 +02:00

..

memstore_events.go

fix(phase-bc): address review findings — auth, SSRF, seq alignment

2026-04-06 09:29:29 +00:00

memstore.go

fix(admin): route admin-panel bans through ModerationService (W1-4)

2026-07-19 08:41:12 +02:00

sqlite_events.go

fix(server): resolve golangci-lint contextcheck, errcheck, gocritic findings

2026-04-07 09:10:14 +02:00

sqlite.go

fix(service): enforce attachment ownership atomically in the link UPDATE (W1-3)

2026-07-19 08:29:26 +02:00

store.go

fix(service): enforce attachment ownership atomically in the link UPDATE (W1-3)

2026-07-19 08:29:26 +02:00