[OpenSpec] 2026-07-24-schema-rbac-hardening

[github-actions]

⚠️ OpenSpec-managed issue — this content is automatically synced
from the openspec/ directory. Manual edits will be overwritten on next sync.

Artifacts

• ✅ Metadata
• ✅ Proposal
• ✅ Specs
• ✅ Design
• ✅ Tasks
• 🔲 Plan
• 🔲 Review

Summary

Closes the remaining schema-level RBAC holes left by vendor-visibility-rbac
(PR #377): gebruik, koppeling, organisatie, and contract each still
carry one or more bare, unscoped role strings in their authorization.read
rule in lib/Settings/softwarecatalogus_register.json, and
AanbodController::getAanbod() still relies on an implicit
null-organisation safeguard instead of an explicit authentication guard.
This change match-scopes every remaining bare role and adds the explicit
guard, closing softwarecatalog #379, #390, and #378 as one
change — same fix shape, same file, same tests as REQ-004/REQ-006 already
established.

Specs

• 📄 vendor-visibility-rbac

Tasks

• Implement
• Test
• Implement
• Test
• Implement
• Test
• Implement
• Test
• Implement
• Test
• All tasks checked off
• openspec validate passes
• Manual testing against acceptance criteria
• Code review against spec requirements
• PHPUnit unit tests for new/changed business logic (tests/Unit/)
• Newman/Postman tests for new/changed API endpoints — N/A, no new/changed public endpoint shape, /api/aanbod and the OpenRegister object API are unchanged wire contracts
• Browser tests (Playwright MCP) for UI changes — N/A, no frontend/UI change, this is a backend RBAC-config and controller-guard fix
• All tests pass (composer test, PHPUnit in the nextcloud:34.0.0-apache container) — 428 suite tests run, 1 pre-existing unrelated failure (PortfolioReportControllerTest::testCsvFormatReturnsDownloadResponse, environment-only Symfony class gap, untouched by this change)
• Feature documentation updated in docs/ (docs/security/vendor-visibility-rbac.md)
• Screenshot captured and committed to docs/images/ — N/A, no UI surface to screenshot; this is a schema-config and backend-controller security fix
• N/A — no new user-facing strings introduced by this change

Design

See design.md for technical design details.

---

Synced from openspec/changes/archive/2026-07-24-schema-rbac-hardening by OpenSpec workflow
App: stackiq