SEC-CAT-002 — Align permission controls with verified authorization
| Field | Value |
|---|---|
| Status | Open finding; source-verified, role matrix pending |
| Severity | High |
| Affected surface | Catalog Permissions and metadata mutation controls |
| Implementation issue | oqullus #535 |
| Code-change repository | sparqd/oqullus |
Where the problem appears
Open Permissions and metadata controls as every Catalog-visible role and exercise only approved disposable changes.
Concrete observed case
Some sensitive controls are rendered without a verified capability contract for each role. Backend permission mutations require platform_admin, while adjacent metadata controls follow different or incomplete enforcement.
Expected condition
Return explicit per-resource capabilities, hide or disable unavailable actions with a reason, and enforce the same matrix in the BFF. Direct, inherited, denied, and unavailable states must be distinguishable.
Cause and evidence
- Ranger grant/revoke routes have an identified admin requirement.
- Catalog surfaces combine permissions and metadata actions with different enforcement paths.
- A complete live role matrix has not been recorded.
Why it matters
Users encounter unexpected 403 responses or infer authority from visible controls; inconsistent enforcement also increases security-review risk.
Existing controls and workarounds
Perform permission changes only as an approved platform administrator and verify the resulting Ranger decision through Trino.
Alternatives considered
- Recommended: server-derived resource capabilities used consistently by UI and API.
- Role-name checks in the browser — rejected because roles and resource scope can drift.
- Show all controls and rely on error responses — rejected as poor UX and weak capability communication.
Component involvement
- BFF is the enforcement authority and capability source.
- Oqullus renders available, unavailable, inherited, and denied states.
- Ranger remains the data-access policy authority.
Reproduction and verification
Follow CAT-S007. Record the visible state, request outcome, effective identity, and recovery behavior relevant to this finding.
Resolution conditions
Close when the complete actor/resource/action matrix is documented and verified through UI, direct API, Ranger policy, Trino enforcement, and audit.
Validation and blockers
Oqullus, BFF, Ranger, security, and product owners must validate the role matrix.