fix(gate-7): a guard helper may spell its object noun after the auth token

[rubenvdlinde]

The defect

_GUARD_HELPER_NAME_RE's first alternative required the authorisation token (Admin/Access/Permission/Permitted/Owner/Allowed/Authori[sz]ed) to be the final CamelCase segment:

r"^(?:is|has|can|may)[A-Z][A-Za-z0-9_]*"
r"(?:Admin|Access|Permission|Permitted|Owner|Allowed|Authori[sz]ed)$"

That rejects the very common verb-object spelling where the object noun trails the auth token — canUserAccessAgent(), hasOwnerPermissionForRun(). These are genuine authorisation predicates, so every routed method delegating to one was reported as an unguarded IDOR.

The fix

The auth token may now be a complete CamelCase segment anywhere after the is|has|can|may prefix. A token is still required; only its position is relaxed.

r"(?:Admin|Access|Permission|Permitted|Owner|Allowed|Authori[sz]ed)"
r"(?:[A-Z][A-Za-z0-9_]*)?$"

Evidence

ConductionNL/hermiq @ development (cd23f547), full-scope run 31490144919, job 93776678440 — gate-7 FAIL, 3 methods, all three false positives:

Method	Guard actually present
AgentsController.php:127 index	filters every result through $this->canUserAccessAgent($agent, $userId) in-body
AgentVersionController.php:105 index	→ loadAccessibleAgent() → canUserAccessAgent(), returns null; caller returns Http::STATUS_NOT_FOUND
AgentVersionController.php:140 diff	same

The 404-on-denial shape is the deliberate tenancy refusal this gate's own FAIL message endorses.

Gate-7 was proven NOT blind on that repo first. A textbook IDOR (#[NoAdminRequired] plantedIdor(string $id) doing a bare objectService->find(id: $id)) was planted into the tracked file lib/Controller/AgentVersionController.php — gate-7 enumerates via git ls-files -- lib/Controller, so an untracked plant is never scanned — and the count went 3 → 4. Plant removed.

Verification

Existing suite: 86 tests, all pass unchanged.

Added: 7 tests under VerbObjectGuardHelperNames — both hermiq shapes (in-body per-object filter; Pattern-4 transitive closure through a loader whose own name carries no token and whose body has no strict deny signal), plus abuse controls.

Revert check: with the pre-patch regex restored, the three PASS-shape tests go RED:

test_in_body_verb_object_predicate_clears_caller ......... FAIL
test_loader_delegating_to_verb_object_predicate_clears_caller ... FAIL
test_verb_object_name_without_an_auth_token_is_not_a_guard_name . FAIL

The first draft of the Shape-A fixture passed identically under the old regex — the method took no caller input, so the session-scoped/zero-reference exemption cleared it before the guard-helper pattern was ever consulted. The fixture now reads pagination params, so the object reference is real and the helper's name is the only thing standing between it and a finding. That near-miss is recorded in a comment on the fixture.

The negative controls are real boundaries, not structurally-always-flagged. With byte-identical bodies, only the helper name changed:

helper name	verdict
canRender	finding
canUserAccessWidget	cleared
hasChanges	finding
hasOwnerPermissionForDraft	cleared

A positive control of the unguarded-fetch shape already exists twice (RealIdorViolationTest.test_no_guard_at_all_is_flagged, docblock form; ZeroInputReadOnlyEndpoints.test_tp_a_method_taking_an_id_is_still_reported, attribute form) and is deliberately not duplicated.

Fleet sanity sweep

Ran before and after over git ls-files 'lib/Controller/*.php' 'lib/Controller/**/*.php' in every local app with a lib/Controller:

app	before	after
hermiq	3	0
docudesk	2	2
hrmq	1	1
openregister, openconnector, opencatalogi, decidesk, doriath, larpingapp, openbuild, pipelinq, portaliq, procest, scholiq, shillinq, softwarecatalog, petstore, app-versions, nextcloud-app-template	0	0

Only the three hermiq false positives were cleared, fleet-wide. Each was opened and confirmed to carry a genuine per-object authorisation guard. The remaining findings (docudesk AnonymizationController::updateRelation, EmlPreviewController::preview; hrmq AdministrationController::setActive) are untouched.

Note: canUserModifyAgent — cited in passing while scoping this — correctly still does not match, since Modify is not an auth token.