authorization-logic-review

Authorization Logic Review

Cites: [severity-floors]

Map the authorization model first, then check consistent enforcement. Report the gap between stated policy and observed implementation — not single suspicious lines.

Context needs: project-structure

Inputs

1. Target repo files — RECON-scoped or grep-discovered
2. memory/recon-<slug>.json — entry points + security surface
3. knowledge/authz-review-categories.yaml — rule_id + CWE assignments

Output

• memory/authz-review-<slug>.json — JSON array of unified findings. Schema: plugins/dev-team/knowledge/schemas/unified-finding-v1.json.

Required metadata: source: "llm-reasoning", cwe[], confidence (high|medium only), secondary_locations[] (≥ 1 policy + gap pairing), reasoning (2-3 sentences).

Procedure

1. Map the authorization model

Discover how the application declares and enforces access control:

• Route decorators / middleware annotations (@require_auth, @roles_allowed, [Authorize(Roles=...)], router.use(authMiddleware))
• Permission constants and role definitions (permissions.py, roles.js, AuthorizationPolicy.cs, scopes.go)
• Middleware stacks (Express chain, Django middleware list, ASP.NET Core pipeline)
• Tenancy models (tenant_id, organization_id, account_id in models or query builders)

Classify as RBAC, ABAC, ACL, tenancy-scoped, or mixed. Note where the predominant pattern is declared.

2. Identify enforcement points

Per route or operation class, note where authorization is enforced:

• Controller / handler — checked before business logic runs
• Service layer — checked inside business logic
• Repository / data-access — enforced in the query (e.g. .where(tenant_id=current_tenant))
• Not found — no enforcement located

Gaps in this {operation → enforcement} map are findings.

3. Tenant isolation consistency

If a tenancy model is present:

• Grep direct object-load patterns that could return cross-tenant data: findById, getById, SELECT ... WHERE id = ? without a tenant filter.
• Check whether ORM base query builder / repository base class enforces tenancy (global scope = OK; ad-hoc per-query = risky).
• Note admin or superuser paths that bypass tenancy for legitimate reasons — acknowledged bypasses, not findings.