Evidence: role sweep, auth-route and server-action results (sanitized, stale parts re-run)

[NewWorldVenture]

Draft, evidence only: one new directory, docs/audit/evidence/2026-09-30-role-auth-server-action/. No code, no migrations, no finalaudit.md change. Everything ran on a local stack, and no production acceptance is claimed. SEC-001 is out of scope (the owner keeps family-media public).

What it preserves

The raw results behind ledger entries this session already put on main, sanitized. Each result names its source commit, the command, the audit ids it supports, and what later changes made stale.

Evidence	Source commit(s)	Result
B7 second pass: teen and /kid-login child, 354 signed-in routes	cfa20b7b4 (1280 px); 11410c9fa (plan-gated and 390 px, the B7 fixes that reached main as 1d992562f, 5402f873c, 277238195)	1,470 loads. Every /admin route and /auth/step-up send both roles to /dashboard, and family-access sends them to /home. P-19 to P-22 fixed.
B14 axe: parent, /kid-login child, super admin	877d9a5eb (first pass); 934219b5d (re-crawl)	15, 4 and 1 pages with violations, then 0 on all 628 loads
Plan gate (MAIN-F15 to F18)	877d9a5eb	21/21
Kid login exact match (MAIN-F22)	877d9a5eb	Pattern usernames get no session
Admin marketing routes (MAIN-F-E09)	8f6155a37	Parent and teen get 403
AUTH-005, signed-out API call	Reproduced on 8f6155a37; fixed in a9ded47c6	Fetch or JSON request gets 401 {"code":"unauthenticated"}; navigation gets a 307 to /login
SEC-023, 61 server-action returns of raw DB error text	be9df6045, ported as 418be2008	Every site goes through describeActionError; a ratchet holds app/ at zero
Historical route-auth marker scan	de5763140 (2026-09-13)	Kept, marked stale, superseded by #619

Stale, and what was re-run (2026-09-30, local, a build of main's web code)

Only the affected checks were re-run; the full sweeps were not repeated. Staleness was measured as each check's import closure against the files changed since its source commit.

• B7: 50 crawled page files changed since cfa20b7b4. Its role-redirect closure changed (isSuperAdmin gained an optional client argument).
  • Re-run: the 82-route role-redirect subset. 82/82 as the teen and 82/82 as the child, unchanged.
  • Per-page render results for the 50 changed pages stay stale.
• B14: 15 crawled page files and 114 component files changed since 934219b5d. The axe results for those are stale and were not re-crawled; B14's guard tests pass.
• Plan gate: its closure changed, but none of the changes touch the gate. Re-run 21/21, with the household's plan confirmed restored.
• Kid login: its closure changed (kid-login-form.tsx, otp.ts). Re-run: maya% and mayarive_a get only a PKCE-initiation cookie and no session; the real username signs in.
• MAIN-F-E09: its closure changed additively (role label keys, types). Re-run: identical 403s.
• AUTH-005: its closure is unchanged since a9ded47c6. Re-run anyway:
  • fetch or JSON requests get 401 on five protected endpoints;
  • navigations get a 307 to /login.
• SEC-023 and every other guard: 51 guard files, 837 tests, pass on main bc147c761.

Audit rows the evidence supports

Each row is supported for the named dimension only; statuses are left to the ledger writer.

• Findings:
  • AUTH-005;
  • MAIN-F-E09, MAIN-F15, F16, F17, F18, MAIN-F22;
  • MAIN-F-D02, F-D03, F-D05 (stale for 15 changed pages);
  • P-19 to P-22 and P-27 to P-31;
  • SEC-023.
• API rows:
  • API-192980CC87C1, API-77A1BDDE52B2, API-68728C68AD8D (authorization);
  • API-5DF6AEE61A0B, API-BE4AC9438408, API-C282DCE0790A (plan gate and signed-out 401).
• 55 ACTION rows, for the error surface only (sec-023-actions.tsv).
• 351 UI-ROUTE rows, for role reach and axe (route-rows.jsonl, stale where marked).
• Partial:
  • UI-WF-001 (child PIN);
  • AUTH-002 (signed-out behaviour, not persistence);
  • SUPPORT-3C67EB27B539 (middleware.ts, signed-out branch);
  • ROLE-0D5E0E2A8906 and ROLE-8B7ECBCBD636.

Sanitized, and limits

• Left out: Playwright storage states, the child's PIN, the persona password, env files, cookie values, raw page text and screenshots. Crawl rows are reduced to route, status, landing path, h1 count, overflow, verdict and error counts. Error text keeps its first line only, and URLs lose their query strings. The household is a seeded local fixture.
• Limits:
  • local only;
  • teen and child for B7, parent, child and super admin for B14; no adult, caregiver or guest;
  • 1280 and 390 px only;
  • endpoint checks prove the gate, not the feature (no provider keys locally);
  • a client that sends neither Sec-Fetch-Mode nor JSON Accept still follows the redirect to a 200 login page, by design.
• Observation, not assessed: POST /api/autopilot/scan checks the plan but not the member's role. A teen's call answered 200 (scanned: 0). No finding is raised.

Checks: the 87 test files that scan the tracked tree pass with this directory present. Lint and typecheck do not cover docs/.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DXw2nu25BjyRfA6Fg3YiMS

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
bubaly	Ignored		Sep 30, 2026 3:21pm UTC

[NewWorldVenture]

[P3, evidence accuracy] Retain the missing-heading exception in the historical B14 summary.

At exact head dcd4b11, filtering b14-axe-2026-09-27.jsonl to crawl="re-crawl on the fixed build" gives 628 loads: 627 have h1=1 and one has h1=0. All 628 still have zero axe violations. I independently repeated that count against exact blob ae3d579fede737931f625a34ca2cd59e54873759.

The exception is raw line 830: the Family+ parent vacation-detail fixture load returns 200, retains the requested finalPath, and records h1:0, violations:[].

Bubaly/docs/audit/evidence/2026-09-30-role-auth-server-action/b14-axe-2026-09-27.jsonl

Line 830 in dcd4b11

{"crawl": "re-crawl on the fixed build", "source": "934219b5d", "role": "Family+ parent", "path": "/dashboard/vacations/a0000000-0000-4000-8000-000000000001", "status": 200, "finalPath": "/dashboard/vacations/a0000000-0000-4000-8000-000000000001", "h1": 0, "violations": []}

README line 77 says every route has exactly one h1. Suggested wording: “The historical re-crawl recorded zero axe violations across 628 loads; 627 recorded one h1, while the parent vacation-detail load recorded zero.” The exception maps to existing UI-ROUTE-0281 at route-rows.jsonl line 275. The unchanged raw blob and universal claim also remain in the integrated evidence/main ledger, including MAIN-F-D05; please preserve the exception there when reconciling the evidence.

This is a historical-summary correction, not a new browser run, present UI defect, production failure or reason to reopen every heading fix. Current import freshness is not established by a page-only changed flag. Other reviewed totals reconcile: 1,470 B7 loads; 1,256 B14 rows = 628 initial + 628 re-crawl; 164 rerun redirect checks = 82 routes x two roles; 351 distinct mapped route IDs. The older swapped action mappings were already corrected by #676. AUTH-002 correctly excludes persistence acceptance, and the stale-page, role, provider and local-only limitations remain explicit.

No browser, sweep, SQL or provider execution; no shared/author source, ledger or configuration changes, new audit IDs, or closure credit. The evidence reviewer used in-memory reads only and wrote no files.