audit-rbac

Audit the specified files or directories for RBAC and audit log compliance. **Fix every issue found immediately.** ## Rules ### API Endpoints (NestJS — `apps/api/src/`) 1. **Every mutation endpoint** (POST, PATCH, PUT, DELETE) MUST have `@RequirePermission('resource', 'action')`. If missing, **add it**. 2. **Read endpoints** (GET) should have `@RequirePermission('resource', 'read')`. If missing, **add it**. 3. **Self-endpoints** (e.g., `/me/preferences`) may skip `@RequirePermission` — authentication via `HybridAuthGuard` is sufficient. 4. **Controller format**: Must use `@Controller({ path: 'name', version: '1' })`, NOT `@Controller('v1/name')`. If wrong, **fix it**. 5. **Guards**: Use `@UseGuards(HybridAuthGuard, PermissionGuard)` at controller or endpoint level. Never skip PermissionGuard. 6. **Webhooks**: External webhook endpoints use `@Public()` — no auth required. ### Frontend Components (`apps/app/src/`) 1. **Every mutation element** (button, form submit, toggle, switch, file upload) MUST be gated with `usePermissions` from `@/hooks/use-permissions`. If not: - **Create/Add buttons**: Wrap with `{hasPermission('resource', 'create') && <Button>...` - **Edit/Delete in dropdown menus**: Wrap the menu item - **Inline form fields on detail pages**: Add `disabled={!canUpdate}` - **Status/property selectors**: Add `disabled={!canUpdate}` 2. **Actions columns** in tables: hide entire column when user lacks write permission. 3. **No manual role string parsing** (`role.includes('admin')`) — use `hasPermission()`. 4. **Nav items**: gate with `canAccessRoute(permissions, 'routeSegment')`. 5. **Page-level**: call `requireRoutePermission('segment', orgId)` server-side. ### Permission Resources `organization`, `member`, `control`, `evidence`, `policy`, `risk`, `vendor`, `task`, `framework`, `audit`, `finding`, `questionnaire`, `integration`, `apiKey`, `trust`, `pentest`, `app`, `compliance` ### Multi-Product RBAC - Products (compliance, pen testing) are org-level feature flags — NOT RBAC - `app:read` gates compliance dashboard; `pentest:read` gates security product - Custom roles can grant access to any combination of resources - Portal-only resources (`policy`, `compliance`) do NOT grant app access ## Process 1. Read files specified in `$ARGUMENTS` (or scan the directory) 2. Check each rule above 3. **Fix every violation immediately** — don't just report 4. Run typecheck to verify: `bunx turbo run typecheck --filter=@trycompai/api --filter=@trycompai/app`