Any signed-in user can read every task dependency, also in projects they are not a member of

[rubenvdlinde]

Low priority. An edge carries only two task uuids and a link type, no titles or content.

What happens

Any signed-in user can list every task dependency edge in the instance through OpenRegister's objects API. That includes edges between tasks in projects the user is not a member of. Every other project-scoped schema (task, column, projectPhase, plannedTimeEntry) limits reads to project members.

Why

Read at development 6fa5ef5.

• lib/Settings/planninq_register.json:1119 sets dependency.authorization.read to {"group": "authenticated"} with no match clause.
• Compare task at :51, which matches project against projects whose members contain $userId.
• The dependency schema has no project property, so the task pattern cannot be copied as is.
• Writes are fine. create, update and delete are admin only in the schema, and lib/Service/DependencyService.php:112 checks project membership before it writes.

Fix direction

1. Add a project property to dependency. DependencyService::create() already resolves the shared project id, so it can store it.
2. Scope read with the same $lookup on project membership that task uses.
3. Back-fill project on existing edges in a repair step.

Live check

1. As user A, create an edge between two tasks in a project that user B is not a member of.
2. As B, call GET /apps/openregister/api/objects/planninq/dependency. Expected today: A's edge is listed.

Matrix rows

plt-rbac in openspec/parity/capabilities.json (PR #645). The row names OpenRegister as owner because it enforces the rule, but the rule itself lives in this repo.

Related: #250 (security backlog).

[github-actions]

Thank you for opening this issue! It has been assigned to @rubenvdlinde for review.

What happens next:

1. A maintainer will review this issue and determine the appropriate action
2. If accepted, it may be converted into an OpenSpec change for structured development
3. You will be notified of any status changes

Triage labels:

• triage:accept-feature — accepted as a new feature
• triage:accept-bugfix — accepted as a bug fix
• triage:needs-info — more information needed
• triage:wontfix — will not be addressed
• triage:duplicate — duplicate of another issue

[rubenvdlinde]

Step 2 of the fix direction above does not work. OpenRegister has no $lookup operator. It stores the rule, uses the $lookup map as the literal operand of $in, and matches no row. On task that locked every project member out of their own tasks (#681, openregister#4089).

#683 replaces the lookup on task, column, projectPhase and plannedTimeEntry. Each now carries a hidden members list, a copy of its project's members plus its owner, matched with {"members": {"$contains": "$userId"}}. Planninq keeps the list in step: ProjectMemberAccessListener on every create and update, ProjectMembershipSyncListener when a project's membership changes, and the BackfillProjectMembers repair step for existing rows.

For dependency the same pattern applies. Store the shared project on the edge (step 1 still holds), then add dependency to ProjectMembershipService::SCOPED_SCHEMAS and give it a members property and the $contains read rule. The back-fill of step 3 then comes from BackfillProjectMembers. Do not copy the $lookup.