fix: harden RBAC permission boundaries

.env.example

@@ -21,7 +21,8 @@ PN_ENTRA_MEMBER_GROUP_ID=1c68dbb8-4ac3-4569-a886-283b5a825cbd
 # Microsoft Entra security group whose direct members hold the built-in Direttivo role.
 # Unset: nobody is inferred as Direttivo.
 # PN_ENTRA_DIRETTIVO_GROUP_ID=
-# Membership is checked with Microsoft Graph again after this interval.
+# Lifetime of persisted sign-in evidence. Authorization independently rechecks Graph
+# using a fixed maximum 60-second cache; this setting cannot extend RBAC access.
 PN_ENTRA_MEMBER_REFRESH_HOURS=24
 
 # Google login.
@@ -39,9 +40,9 @@ PN_ENTRA_MEMBER_REFRESH_HOURS=24
 AZURE_EMAIL_SENDER=noreply@polinetwork.org
 STUDENT_VERIFICATION_TTL_DAYS=365
 
-# Who holds the built-in Master Admin role, which carries every permission. By default
-# every signed-in PN Entra account does. Set this to a stricter Microsoft Entra group
-# (object ID) to limit it to that group's direct members; the PN_ENTRA app checks it
+# Who holds the built-in Master Admin role, which carries every permission. Configure
+# this Microsoft Entra administrators group (object ID) or a nonempty allowlist below.
+# Missing both stops startup. Group membership is verified by the PN_ENTRA app
 # through Graph. Everyone else is administered through roles at /access.
 # PN_ENTRA_OIDC_ADMIN_GROUP_ID=
 # Comma-separated local user IDs that are always Master Admin (break-glass).

Dockerfile

@@ -63,6 +63,7 @@ COPY --from=build --chown=node:node /app/.output ./.output
 COPY --from=build --chown=node:node /app/drizzle ./drizzle
 COPY --from=build --chown=node:node /app/scripts/migrate.mjs ./scripts/migrate.mjs
 COPY --from=build --chown=node:node /app/scripts/start.mjs ./scripts/start.mjs
+COPY --from=build --chown=node:node /app/scripts/security-config.mjs ./scripts/security-config.mjs
 USER node
 EXPOSE 3000
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \

docker/write-runtime-package.mjs

@@ -8,7 +8,7 @@
 // the versions bundled into .output, which matters for Sentry in particular.
 import { readFileSync, writeFileSync } from "node:fs";
 
-const runtimePackages = ["@sentry/tanstackstart-react", "drizzle-orm", "pg"];
+const runtimePackages = ["@sentry/tanstackstart-react", "drizzle-orm", "pg", "zod"];
 
 const dependencies = Object.fromEntries(
   runtimePackages.map((name) => {

drizzle/0006_volatile_pandemic.sql

@@ -1,9 +1,10 @@
 ALTER TABLE "permission" ADD COLUMN "managed" boolean DEFAULT false NOT NULL;--> statement-breakpoint
 -- Master Admin holds every permission that exists, as a wildcard rather than a stored
 -- grant list, so it keeps covering permissions created later. Its membership comes from
--- IDP_ADMIN_USER_IDS or the configured Entra administrators group rather than from
--- identity evidence, which is why it has no source_state: that is the bootstrap path that
--- keeps the service from being locked out of its own administration.
+-- IDP_ADMIN_USER_IDS or the Entra administration policy rather than from identity evidence.
+-- Master Admin requires an explicitly configured administrators group or user allowlist.
+-- It has no source_state because deployment configuration provides the bootstrap path
+-- independently of the editable role graph.
 INSERT INTO "role" ("id", "key", "name", "description", "managed", "source_state") VALUES
 	('static-role-master-admin', 'master-admin', 'Master Admin', 'Complete control of this identity provider.', true, NULL)
 ON CONFLICT ("key") DO NOTHING;--> statement-breakpoint

drizzle/0007_mushy_the_fury.sql

@@ -0,0 +1,51 @@
+CREATE TABLE "rbac_audit_event" (
+	"id" text PRIMARY KEY NOT NULL,
+	"actor_id" text NOT NULL,
+	"operation" text NOT NULL,
+	"target_id" text NOT NULL,
+	"before" jsonb NOT NULL,
+	"after" jsonb NOT NULL,
+	"createdAt" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE FUNCTION reject_rbac_audit_mutation() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  RAISE EXCEPTION 'RBAC audit events are append-only';
+END;
+$$;
+--> statement-breakpoint
+CREATE TRIGGER rbac_audit_append_only BEFORE UPDATE OR DELETE OR TRUNCATE ON rbac_audit_event
+FOR EACH STATEMENT EXECUTE FUNCTION reject_rbac_audit_mutation();
+--> statement-breakpoint
+CREATE FUNCTION guard_managed_role_links() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  IF TG_TABLE_NAME = 'user_role' THEN
+    IF EXISTS (SELECT 1 FROM role WHERE id = NEW.role_id AND managed) THEN
+      RAISE EXCEPTION 'Managed roles cannot be assigned';
+    END IF;
+  ELSE
+    IF EXISTS (SELECT 1 FROM role WHERE id = NEW.parent_role_id AND key = 'master-admin') THEN
+      RAISE EXCEPTION 'Master Admin cannot be inherited';
+    END IF;
+  END IF;
+  RETURN NEW;
+END;
+$$;
+--> statement-breakpoint
+CREATE TRIGGER user_role_unmanaged_only BEFORE INSERT OR UPDATE ON user_role
+FOR EACH ROW EXECUTE FUNCTION guard_managed_role_links();
+--> statement-breakpoint
+CREATE TRIGGER role_parent_no_master BEFORE INSERT OR UPDATE ON role_parent
+FOR EACH ROW EXECUTE FUNCTION guard_managed_role_links();
+--> statement-breakpoint
+-- Existing unsafe edges/assignments are quarantined in the audit record before removal.
+INSERT INTO rbac_audit_event (id, actor_id, operation, target_id, before, after)
+SELECT 'migration-0007-unsafe-links', 'system:migration:0007', 'quarantine', 'managed-role-links',
+jsonb_build_object(
+  'parents', (SELECT coalesce(jsonb_agg(p), '[]') FROM role_parent p JOIN role r ON r.id = p.parent_role_id WHERE r.key = 'master-admin'),
+  'assignments', (SELECT coalesce(jsonb_agg(a), '[]') FROM user_role a JOIN role r ON r.id = a.role_id WHERE r.managed)
+), '{}'::jsonb;
+--> statement-breakpoint
+DELETE FROM role_parent WHERE parent_role_id IN (SELECT id FROM role WHERE key = 'master-admin');
+--> statement-breakpoint
+DELETE FROM user_role WHERE role_id IN (SELECT id FROM role WHERE managed);