[antosubash]

Tech-debt batch 22 (from the 2026-10-28 scan).

Closes #687

What changed

• Delegated grant writes are bounded by the actor's own access (permissions/write_safety.py). A permissions.manage holder who is not an unscoped admin:

  • may only add permission keys it holds itself, on users and on roles;
  • may not edit a user whose effective permissions exceed its own, or whose roles are unknown (Keycloak), or an admin;
  • may not edit the admin role, or any role holding a key the actor lacks (whether keeping or stripping it).

  Unscoped admins and in-process callers (no request) are unrestricted. The same class of fix users: users.manage can grant admin; no last-admin guard on disable/demote #624 made for users.manage.

• Refusals carry a reason. The API returns a 403 with the reason in detail. The Inertia view routes return it as a form error, which UserEdit and RoleEdit show as the toast instead of the generic "save failed". This is a plain 403, not PermissionDenied, because the actor does hold permissions.manage.

• Grant-cache eviction lives in the service. PermissionService.set_user_permissions evicts the user-grant cache on commit (cross-worker through the bus) for every caller, not just the two endpoints. permissions.deps.invalidate_grants_on_commit is deprecated, remove_in="0.1.0", and listed in test_deprecation_expiry.

Known limits, left as-is deliberately:

• A role carrying stored grants for a disabled module stays uneditable by delegated actors (fail-closed).
• The target check leaves out tenant-role permissions, the same limit as users: users.manage can grant admin; no last-admin guard on disable/demote #624's.

Verification

• make lint ✓ · make test-js ✓ · make test-py ✓ (6375 passed, 39 skipped)
• Code review: an automated security review flagged role-write parity, and the review agent flagged the misleading PermissionDenied; both fixed.
• Browser QA (playwright-cli, 6 scenarios, all pass):
  • an admin grants anything;
  • a manager grants a key it holds;
  • a manager adding an unheld key, editing an admin, or editing the admin role is refused with the reason toasted and nothing saved;
  • the API returns 403 with the reason.
• Rebase note: CHANGELOG.md [Unreleased] conflicted with Tech-debt batch 21: password reset revokes all credentials; admin create/invite after commit (#686 #692) #699; resolved as the union of both entries.

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

[cloudflare-workers-and-pages]

Deploying simple-module-python with    Cloudflare Pages

Latest commit:	0d423d8
Status:	✅  Deploy successful!
Preview URL:	https://f9c835a4.simple-module-python.pages.dev
Branch Preview URL:	https://tech-debt-b22-permissions-es.simple-module-python.pages.dev

View logs

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-30T07:17:22.353708Z	0d423d8	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.