Audit authorize?: false usage in runtime code #728

New issue

Closed

opened 2026-03-28 04:27:53 +00:00 by mfreeman451 · 1 comment

mfreeman451 commented

2026-03-28 04:27:53 +00:00

Owner

Imported from GitHub.

Original GitHub issue: #2264
Original author: @mfreeman451
Original URL: https://github.com/carverauto/serviceradar/issues/2264
Original created: 2026-01-12T04:08:37Z

We should audit and remove/justify authorize?: false usage in runtime code paths (excluding tests/docs/seeds).

Context:

We already removed authorize?: false in sweep settings UI reads and device sweep results read.
A repo-wide search still finds many authorize?: false occurrences in runtime code (web-ng controllers/plugs/admin LiveViews, edge/onboarding flows, core workers/services).

Suggested approach:

Enumerate remaining authorize?: false calls in runtime code (exclude test/support, docs, seeds).
For each, decide whether to:
- remove authorize?: false and rely on policies, or
- replace with appropriate system actor or policy, or
- document a security justification.
Add tests for any authorization changes.

Command used to locate occurrences:
rg -n "authorize\?:\s*false"

Imported from GitHub. Original GitHub issue: #2264 Original author: @mfreeman451 Original URL: https://github.com/carverauto/serviceradar/issues/2264 Original created: 2026-01-12T04:08:37Z --- We should audit and remove/justify authorize?: false usage in runtime code paths (excluding tests/docs/seeds). Context: - We already removed authorize?: false in sweep settings UI reads and device sweep results read. - A repo-wide search still finds many authorize?: false occurrences in runtime code (web-ng controllers/plugs/admin LiveViews, edge/onboarding flows, core workers/services). Suggested approach: 1) Enumerate remaining authorize?: false calls in runtime code (exclude test/support, docs, seeds). 2) For each, decide whether to: - remove authorize?: false and rely on policies, or - replace with appropriate system actor or policy, or - document a security justification. 3) Add tests for any authorization changes. Command used to locate occurrences: rg -n "authorize\\?:\\s*false"

mfreeman451 commented

2026-03-28 04:27:53 +00:00

Author

Owner

Imported GitHub comment.

Original author: @mfreeman451
Original URL: https://github.com/carverauto/serviceradar/issues/2264#issuecomment-3765124462
Original created: 2026-01-18T10:01:10Z

closing, not planned

Imported GitHub comment. Original author: @mfreeman451 Original URL: https://github.com/carverauto/serviceradar/issues/2264#issuecomment-3765124462 Original created: 2026-01-18T10:01:10Z --- closing, not planned