fix: broaden CI audit script to catch all hardcoded role checks (PP-leli.3)

scripts/audit/no-hardcoded-role-checks.sh

@@ -25,7 +25,7 @@ if ! command -v rg >/dev/null 2>&1; then
   echo "Install with: brew install ripgrep   (or: apt-get install ripgrep)" >&2
   exit 2
 fi
-raw=$(rg -n -B1 -A1 '\brole\s*(===|!==)\s*"(admin|technician|member|guest)"' src \
+raw=$(rg -n -B1 -A1 '\b[A-Za-z_$][A-Za-z0-9_$.]*\s*(===|!==)\s*"(admin|technician|member|guest)"' src \
   --glob '!src/lib/permissions/matrix.ts' \
   --glob '!src/lib/permissions/helpers.ts' \
   --glob '!**/*.test.*' \
@@ -62,6 +62,14 @@ matches=$(echo "$raw" | awk '
     if (parsed == "") next
     n = split(parsed, parts, SUBSEP)
     file = parts[1]; lineno = parts[2] + 0; sep = parts[3]; content = parts[4]
+
+    # Skip pure comment/JSDoc lines — they describe role checks, not perform them.
+    if (content ~ /^[[:space:]]*(\*|\/\/|\/\*)/) {
+      if (sep == ":") {
+        next
+      }
+    }
+
     # Record allow markers at this (file, lineno).
     if (content ~ /permissions-audit-allow:/) {
       allow[file, lineno] = 1

scripts/tests/test_no_hardcoded_role_checks.py

@@ -0,0 +1,65 @@
+from __future__ import annotations
+
+import shutil
+import subprocess
+from pathlib import Path
+
+import pytest
+
+PROJECT_ROOT = Path(__file__).resolve().parents[2]
+SCRIPT = PROJECT_ROOT / "scripts/audit/no-hardcoded-role-checks.sh"
+pytestmark = pytest.mark.skipif(
+    shutil.which("rg") is None,
+    reason="role-audit regression tests require the script's ripgrep prerequisite",
+)
+
+
+def run_audit(tmp_path: Path, source: str) -> subprocess.CompletedProcess[str]:
+    src = tmp_path / "src"
+    src.mkdir()
+    (src / "example.ts").write_text(source)
+    return subprocess.run(
+        ["bash", str(SCRIPT)],
+        cwd=tmp_path,
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+
+
+def test_detects_arbitrary_identifiers_and_property_access(tmp_path: Path) -> None:
+    result = run_audit(
+        tmp_path,
+        'if (accessLevel === "admin" || currentUser.role !== "guest") {}\n',
+    )
+
+    assert result.returncode == 1
+    assert 'accessLevel === "admin"' in result.stderr
+
+
+def test_ignores_role_comparisons_on_pure_comment_lines(tmp_path: Path) -> None:
+    result = run_audit(
+        tmp_path,
+        """// accessLevel === \"admin\"
+/* currentUser.role !== \"guest\" */
+/**
+ * role === \"technician\"
+ */
+export const harmless = true;
+""",
+    )
+
+    assert result.returncode == 0
+    assert result.stderr == ""
+
+
+def test_accepts_an_adjacent_allow_marker(tmp_path: Path) -> None:
+    result = run_audit(
+        tmp_path,
+        """// permissions-audit-allow: display-only label
+if (viewer.role === \"member\") {}
+""",
+    )
+
+    assert result.returncode == 0
+    assert result.stderr == ""

src/app/(app)/admin/users/actions.ts

@@ -207,7 +207,7 @@ export async function updateUserRole(
     if (
       validated.userType === "active" &&
       validated.userId === user.id &&
-      validated.newRole !== "admin"
+      validated.newRole !== "admin" // permissions-audit-allow: self-demotion invariant
     ) {
       throw new Error("Admins cannot demote themselves");
     }

src/app/(app)/admin/users/user-role-select.tsx

@@ -34,7 +34,7 @@ export function UserRoleSelect({
     if (
       userType === "active" &&
       userId === currentUserId &&
-      newRole !== "admin"
+      newRole !== "admin" // permissions-audit-allow: self-demotion invariant
     ) {
       toast.error("You cannot demote yourself.");
       return;
@@ -58,7 +58,7 @@ export function UserRoleSelect({
       defaultValue={currentRole}
       onValueChange={handleRoleChange}
       disabled={
-        isPending || (userId === currentUserId && currentRole === "admin")
+        isPending || (userId === currentUserId && currentRole === "admin") // permissions-audit-allow: self-demotion invariant
       }
     >
       <SelectTrigger

src/app/(app)/m/[initials]/(tabs)/edit/page.tsx

@@ -227,8 +227,7 @@ export default async function MachineEditPage({
     }))
   );
 
-  const canEditAnyMachine =
-    accessLevel === "admin" || accessLevel === "technician";
+  const canEditAnyMachine = checkPermission("machines.edit", accessLevel);
   const isOwner =
     user.id === machine.ownerId || user.id === machine.invitedOwnerId;
 

src/app/(app)/m/page.tsx

@@ -24,7 +24,7 @@ import {
   sortMachines,
 } from "~/lib/machines/filters-queries";
 import { MachineFilters } from "~/components/machines/MachineFilters";
-import { getAccessLevel } from "~/lib/permissions/helpers";
+import { checkPermission, getAccessLevel } from "~/lib/permissions/helpers";
 import { formatDate } from "~/lib/dates";
 import { PageContainer } from "~/components/layout/PageContainer";
 import { PageHeader } from "~/components/layout/PageHeader";
@@ -40,7 +40,7 @@ interface MachinesPageProps {
  * Status hierarchy: unplayable > needs_service > operational
  *
  * Accessible to all users (unauthenticated, guest, member, admin).
- * The "Add Machine" button is only shown to admins.
+ * The "Add Machine" button follows the machines.create permission.
  */
 export default async function MachinesPage({
   searchParams,
@@ -150,19 +150,20 @@ export default async function MachinesPage({
     filters.sort ?? "name_asc"
   );
 
-  const addMachineButton =
-    accessLevel === "admin" || accessLevel === "technician" ? (
-      <Button
-        asChild
-        className="bg-primary text-on-primary hover:bg-primary/90"
-        data-testid="add-machine-button"
-      >
-        <Link href="/m/new">
-          <Plus className="mr-2 size-4" />
-          Add Machine
-        </Link>
-      </Button>
-    ) : undefined;
+  const canCreateMachine = checkPermission("machines.create", accessLevel);
+
+  const addMachineButton = canCreateMachine ? (
+    <Button
+      asChild
+      className="bg-primary text-on-primary hover:bg-primary/90"
+      data-testid="add-machine-button"
+    >
+      <Link href="/m/new">
+        <Plus className="mr-2 size-4" />
+        Add Machine
+      </Link>
+    </Button>
+  ) : undefined;
 
   return (
     <PageContainer size="wide">
@@ -189,12 +190,12 @@ export default async function MachinesPage({
               icon={Plus}
               title="No machines yet"
               description={
-                accessLevel === "admin" || accessLevel === "technician"
+                canCreateMachine
                   ? "Get started by adding your first machine to the collection."
                   : "No machines have been added to the collection yet."
               }
               action={
-                accessLevel === "admin" || accessLevel === "technician" ? (
+                canCreateMachine ? (
                   <Button
                     asChild
                     className="bg-primary text-on-primary hover:bg-primary/90"

src/app/(app)/report/unified-report-form.tsx

@@ -28,6 +28,7 @@ import { StatusSelect } from "~/components/issues/fields/StatusSelect";
 import { ImageUploadButton } from "~/components/images/ImageUploadButton";
 import { ImageGallery } from "~/components/images/ImageGallery";
 import type { AccessLevel } from "~/lib/permissions/matrix";
+import { checkPermission } from "~/lib/permissions/helpers";
 import { getLoginUrl } from "~/lib/login-url";
 import { RecentIssuesPanelClient } from "~/components/issues/RecentIssuesPanelClient";
 import { RichTextEditor } from "~/components/editor/RichTextEditorDynamic";
@@ -314,10 +315,9 @@ export function UnifiedReportForm({
     };
   }, [currentInitials]);
 
-  const canSetWorkflowFields =
-    accessLevel === "admin" ||
-    accessLevel === "technician" ||
-    accessLevel === "member";
+  const canSetStatus = checkPermission("issues.report.status", accessLevel);
+  const canSetPriority = checkPermission("issues.report.priority", accessLevel);
+  const canSetAssignee = checkPermission("issues.report.assignee", accessLevel);
 
   return (
     <div className="w-full">
@@ -491,36 +491,44 @@ export function UnifiedReportForm({
               </div>
             </div>
 
-            {/* Priority + Status: always side-by-side when visible */}
-            {canSetWorkflowFields && (
+            {/* Priority + Status: side-by-side when both are visible */}
+            {(canSetPriority || canSetStatus) && (
               <div className="grid grid-cols-2 gap-3">
-                <div className="space-y-1.5">
-                  <Label htmlFor="priority" className="text-foreground">
-                    Priority *
-                  </Label>
-                  <input type="hidden" name="priority" value={entry.priority} />
-                  <PrioritySelect
-                    id="priority"
-                    value={entry.priority}
-                    onValueChange={(v) => patchEntry(0, { priority: v })}
-                  />
-                </div>
-                <div className="space-y-1.5">
-                  <Label htmlFor="status" className="text-foreground">
-                    Status *
-                  </Label>
-                  <input type="hidden" name="status" value={entry.status} />
-                  <StatusSelect
-                    id="status"
-                    value={entry.status}
-                    onValueChange={(v) => patchEntry(0, { status: v })}
-                  />
-                </div>
+                {canSetPriority && (
+                  <div className="space-y-1.5">
+                    <Label htmlFor="priority" className="text-foreground">
+                      Priority *
+                    </Label>
+                    <input
+                      type="hidden"
+                      name="priority"
+                      value={entry.priority}
+                    />
+                    <PrioritySelect
+                      id="priority"
+                      value={entry.priority}
+                      onValueChange={(v) => patchEntry(0, { priority: v })}
+                    />
+                  </div>
+                )}
+                {canSetStatus && (
+                  <div className="space-y-1.5">
+                    <Label htmlFor="status" className="text-foreground">
+                      Status *
+                    </Label>
+                    <input type="hidden" name="status" value={entry.status} />
+                    <StatusSelect
+                      id="status"
+                      value={entry.status}
+                      onValueChange={(v) => patchEntry(0, { status: v })}
+                    />
+                  </div>
+                )}
               </div>
             )}
 
             {/* Assign To: full-width */}
-            {canSetWorkflowFields && assignees.length > 0 && (
+            {canSetAssignee && assignees.length > 0 && (
               <div className="space-y-1.5">
                 <Label htmlFor="assignedTo" className="text-foreground">
                   Assign To

src/app/(auth)/oauth/consent/actions.ts

@@ -45,6 +45,7 @@ async function decideConsent(
 
   const accessLevel = await getUserAccessLevel(user.id);
   if (accessLevel !== "admin") {
+    // permissions-audit-allow: OAuth consent gate
     // Non-admins can't authorize the MCP surface. Bounce back to the page,
     // which renders the admin-only notice.
     redirect(consentUrl(authorizationId));

src/app/(auth)/oauth/consent/page.tsx

@@ -58,6 +58,7 @@ export default async function OAuthConsentPage({
 
   const accessLevel = await getUserAccessLevel(user.id);
   if (accessLevel !== "admin") {
+    // permissions-audit-allow: OAuth consent gate
     return (
       <ConsentNotice
         title="Admin access required"

src/components/issues/IssueTimeline.tsx

@@ -47,6 +47,7 @@ import {
   AlertDialogTitle,
 } from "~/components/ui/alert-dialog";
 import { type AccessLevel } from "~/lib/permissions/matrix";
+import { checkPermission } from "~/lib/permissions/helpers";
 import { RichTextDisplay } from "~/components/editor/RichTextDisplay";
 import { RichTextEditor } from "~/components/editor/RichTextEditorDynamic";
 import { type ProseMirrorDoc } from "~/lib/tiptap/types";
@@ -225,11 +226,14 @@ function TimelineItem({
   // Edit: only the comment author can edit their own comments
   const canEdit =
     currentUserId === event.author.id && !event.isSystem && !isIssue;
-  // Delete: author can delete own comments, admins can delete any comment
+  // Delete: authors can delete their own comments; admins can delete any.
+  const canDeleteOwn = checkPermission("comments.delete", currentUserRole, {
+    userId: currentUserId ?? undefined,
+    reporterId: event.author.id,
+  });
+  const canDeleteAny = checkPermission("comments.delete.any", currentUserRole);
   const canDelete =
-    (currentUserId === event.author.id || currentUserRole === "admin") &&
-    !event.isSystem &&
-    !isIssue;
+    (canDeleteOwn || canDeleteAny) && !event.isSystem && !isIssue;
 
   const canShowActions = canEdit || canDelete;
 

src/components/machines/OwnerSelect.tsx

@@ -210,19 +210,19 @@ export function OwnerSelect({
               {selectedUser ? (
                 <>
                   {selectedUser.name}
-                  {selectedUser.role !== "guest" &&
+                  {selectedUser.role !== "guest" && // permissions-audit-allow: UI display filter
                     selectedUser.status === "invited" && ( // permissions-audit-allow: UI badge display, not a permission gate
                       <span className="ml-1 text-[10px] font-medium uppercase tracking-wider text-muted-foreground">
                         (Invited)
                       </span>
                     )}
-                  {selectedUser.role === "guest" &&
+                  {selectedUser.role === "guest" && // permissions-audit-allow: UI display filter
                     selectedUser.status !== "invited" && ( // permissions-audit-allow: UI badge display, not a permission gate
                       <span className="ml-1 text-[10px] font-medium uppercase tracking-wider text-muted-foreground">
                         (GUEST)
                       </span>
                     )}
-                  {selectedUser.role === "guest" &&
+                  {selectedUser.role === "guest" && // permissions-audit-allow: UI display filter
                     selectedUser.status === "invited" && ( // permissions-audit-allow: UI badge display, not a permission gate
                       <span className="ml-1 text-[10px] font-medium uppercase tracking-wider text-muted-foreground">
                         (INVITED · GUEST)

src/lib/machines/settings-permissions.ts

@@ -26,7 +26,7 @@ export interface SettingsSetAuth {
 }
 
 const isTechPlus = (access: AccessLevel): boolean =>
-  access === "technician" || access === "admin";
+  access === "technician" || access === "admin"; // permissions-audit-allow: per-set authorization matrix logic
 
 const isMachineOwner = (
   machineOwnerId: string | null,
@@ -42,7 +42,7 @@ export function canViewSet(
   viewerId: string | null,
   access: AccessLevel
 ): boolean {
-  if (set.isPublic || set.isPreferred || access === "admin") return true;
+  if (set.isPublic || set.isPreferred || access === "admin") return true; // permissions-audit-allow: per-set authorization matrix logic
   return set.createdById !== null && set.createdById === viewerId;
 }
 
@@ -57,7 +57,7 @@ export function canEditSet(
   access: AccessLevel
 ): boolean {
   if (!canViewSet(set, viewerId, access)) return false;
-  if (access === "admin") return true;
+  if (access === "admin") return true; // permissions-audit-allow: per-set authorization matrix logic
   if (isMachineOwner(machineOwnerId, viewerId)) return true;
   // An owner set on a machine with NO owner has nobody to protect it for — the
   // 0060 backfill turns every pre-existing preferred set into an owner set,
@@ -79,7 +79,7 @@ export function canSetOwnerDefault(
   access: AccessLevel
 ): boolean {
   if (!set.isOwnerSet) return false;
-  return access === "admin" || isMachineOwner(machineOwnerId, viewerId);
+  return access === "admin" || isMachineOwner(machineOwnerId, viewerId); // permissions-audit-allow: per-set authorization matrix logic
 }
 
 /** Publishing (public toggle) needs the same rights as editing. */