Claude bcdc0ef385 fix(admin): owner gate consumes the context role — no second lookup (OC-0379) ...

OC-0345's fix kept the redundant GetRoleByID its own title named (its
suggestedFix says why: reading adminRoleKey broke two tests that injected
only the user). Finish the job: ownerOnlyMiddleware now consumes the
*db.Role adminAuthMiddleware stored, exactly like requirePerm — missing
role fails closed as 401, position below Owner stays 403, and the query
plus its 503 branch are gone (a role read fault surfaces once, at the
perimeter). The signature drops *db.DB at all nine call sites, so a
reintroduced lookup is a compile-visible change.

Test-first: TestOwnerOnlyMiddleware_NoSecondRoleLookup renames the roles
table away with the role in context and demands 200 — red 503 against the
old code, green now. The old RoleLookupFailureIs503 test guarded a branch
that no longer exists in any form; a tombstone comment records where its
contract lives on (the perimeter's default branch). Added below-owner 403
and user-without-role 401 pins; the blackbox owner-route tests pass
unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B8dwVLEihnGZYtH9X631F4

2026-08-31 04:55:47 +00:00

..

static

fix: 40 correctness fixes from the 2026-08-19 bug hunt (#1392)

2026-08-19 16:32:07 +02:00

admin_handler_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

admin.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

api_edge_cases_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

api_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

api.go

fix(admin): owner gate consumes the context role — no second lookup (OC-0379)

2026-08-31 04:55:47 +00:00

audit_coverage_test.go

feat(b2-6): safe audit coverage (S-02) (#1441)

2026-08-29 11:11:37 +02:00

backup_maintenance_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

backup_maintenance.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

channels_archive_voice_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

emoji_section_test.go

Release v1.2.0-alpha.1 -> main (#1309)

2026-08-01 22:06:14 +02:00

export_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

handlers_backup_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

handlers_backup.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

handlers_channel_perms_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

handlers_channel_perms.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

handlers_channel_user_perms_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

handlers_channels_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

handlers_channels.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

handlers_roles_rename_test.go

fix: resolve 107 verified defects across ws hub, voice/E2EE, db, and client (#1331)

2026-08-07 21:20:48 +02:00

handlers_roles_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

handlers_roles.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

handlers_settings.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

handlers_tokens.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

handlers_users_atomic_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

handlers_users_broadcast_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

handlers_users.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

harvest_s5_roles_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

helpers_internal_test.go

fix: resolve 107 verified defects across ws hub, voice/E2EE, db, and client (#1331)

2026-08-07 21:20:48 +02:00

helpers.go

feat(b2-6): safe audit coverage (S-02) (#1441)

2026-08-29 11:11:37 +02:00

hub_wiring_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

logstream_alloc_test.go

release: v1.1.0-alpha.4 — first-run setup wizard, LiveKit auto-download, WAF & CI fixes (#1292)

2026-07-31 15:41:57 +02:00

logstream_apitoken_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

logstream_atomic_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

logstream_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

logstream.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

main_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

middleware_and_spawn_test.go

fix(admin): owner gate consumes the context role — no second lookup (OC-0379)

2026-08-31 04:55:47 +00:00

middleware_coverage_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

middleware_db_error_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

middleware.go

fix(admin): owner gate consumes the context role — no second lookup (OC-0379)

2026-08-31 04:55:47 +00:00

multihandler_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

perm_gates_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

perm_grid_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

restart_guard_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

restart.go

fix(server): drain fully before the self-update/restore restart handoff (#1380)

2026-08-16 08:25:40 +02:00

setup_clientip_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

setup_clientip.go

Fix 27 findings from 2026-08-21 bug hunt (#1400)

2026-08-21 12:41:56 +02:00

setup_handler_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

setup_handler.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

setup_limiter_reap_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

setup_origin_test.go

fix(admin): accept same-origin first-run setup requests (#1280)

2026-07-30 21:50:13 +02:00

setup_owner_orphan_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

setup_wizard_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

setup_wizard.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

types.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

update_handlers_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

update_handlers.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00