Bug #149
open[HR][Verify] A-01: HR API authorization mode: confirm Audit vs Enforce on the deployed box
0%
Description
Nuvita.Hr.Api/appsettings.json sets Nuvita:Authorization:Mode to Audit. Verified in the kernel (PermissionEnforcement.cs) that Audit mode logs a denial and lets the request through instead of returning 403. Check the hr-api startup log line "Nuvita authorization mode: " on the test and prod box: an environment override would change the severity of every privacy finding in #139.
SV Updated by Sravan V S about 2 months ago
- Assignee set to Sravan V S
S- Updated by SK - 12 days ago
- Status changed from New to Feedback
- Assignee changed from SK - to Sravan V S
- Resolved By set to SK -
Checked the committed code, not just the live box - and found the ticket's own premise is already stale: the committed appsettings.json has set Nuvita:Authorization:Mode to Enforce, not Audit, since 2026-10-22 (commit by Annet Lopez, "ship Authorization.Mode=Enforce (Redmine #467)") - a separate, already-approved ticket, done before today's #139 work even started. There's also a regression-guard test (AuthorizationModeConfigTests) specifically added to stop this config drifting back to Audit. So today's #139 privacy fixes are NOT advisory-only in the code as committed - a caller missing a permission key gets a real 403.
What I cannot check from here: whether the actually DEPLOYED box (test and/or prod) has an environment-variable override (Nuvita__Authorization__Mode=Audit) silently overriding this committed setting at runtime - that's exactly what this ticket is really asking, and it needs someone with access to the deployed box's startup logs or environment config. Assigning to Sravan for that check, same as the other items needing live infra/deployment access today.