Nick SzaunigandClaude Opus 5
b8809eeaa2
Inserting the new PATCH handlers directly above an existing route put them between that route's @RequirePermission decorator and its method, so the decorator bound to the new handler instead: - DELETE /documents/:id lost documents:delete - POST /honey-batches/:id/measurements lost honey-batches:measure - POST /queens/:id/evaluations lost queens:evaluate and each new PATCH ended up carrying two @RequirePermission decorators, of which only one takes effect. This did not open anything up. PermissionsGuard fails closed by decorator absence: a non-public route with neither @RequirePermission nor @AnyAuthenticatedUser is denied outright, so the three routes would have returned 403 for every caller including an administrator. The effect was a broken endpoint, not a bypass. Each decorator is back on the route it belongs to, and the duplicates are gone. test/authorization-coverage.e2e-spec.ts asserts exactly this contract across every route and is the check that should run before a route change ships. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>