Platform Authorization And Access — Current Surface Refresh — 2026-08-08

• Status: CURRENT STATIC SOURCE REFRESH COMPLETE / ENVIRONMENT, ROLE AND RECORD EVIDENCE REQUIRED
• Previous access baseline: qa/master@3c084671c034f8f5136b02dce990ecff6c66d107
• Current review ref: qa/master@2c0dd0bfadde7633337ec4357be1cbf9835c5c8b
• Previous authority: PLATFORM_AUTHORIZATION_ACCESS_SOURCE_AUTHORITY.md
• Current action matrix: PLATFORM_AUTHORIZATION_CURRENT_ACTION_MATRIX_2026-08-08.md
• Read-only evidence package: RBR-ACCESS-001-READONLY-CURRENT-SURFACE-PREFLIGHT.md
• Support addendum: PLATFORM_ACCESS_DIAGNOSTICS_CURRENT_SURFACE_ADDENDUM.md
• Wiki addendum: PLATFORM_ACCESS_CURRENT_SURFACE_WIKI_ADDENDUM.md
• Program state: PHASE IMPLEMENTATION USER HOLD
• Effects: repository source inspection and documentation only

---

1. Purpose

The existing authorization packet correctly separates menu, page, API, command, record and state authority, but its declared source baseline predates several current operational surfaces.

This refresh reconciles the current access contract for:

Loader Work Assignment and Clock Out
Street Turn create and guarded revert
Final Loading Review read/correct/confirm/reopen
AR Billing and QBO delivery
BOL and Packing List email

It answers:

Which page exposes the action?
Which API route receives it?
Which module guard is declared at route level?
Is a menu route or numeric role declared at route level?
Which handler-level actor predicate applies?
Which tenant/record/state predicate applies?
Which external or irreversible effect can occur?
What remains unknown until current role/menu/account evidence is read?

It does not authorize a guard change, role change, access expansion, default denial, provider action or Phase implementation.

---

2. Refresh Result

2.1 Core access infrastructure

The following core owner blobs remain unchanged from the previous access baseline to the current review ref:

config/config.php
index.php
api/index.php
app/shared/api/router.php
config/modules.php

Therefore the foundational interpretation remains current:

Authentication
-> effective tenant context
-> module availability
-> optional menu/role route metadata
-> handler
-> action predicate
-> record predicate
-> record-state predicate

The route dispatcher still cannot prove command or record authorization merely because module access succeeds.

2.2 Operational surface drift

The access packet requires a current addendum because new or materially expanded actions were added in module-owned source after the previous baseline.

The current pattern is:

route metadata often declares moduleKey only
+ handler-specific role/name/self predicate
+ tenant-scoped SQL
+ record-state predicate
= current effective action decision

This is not one shared authorization decision and cannot be migrated by copying only route metadata.

---

3. Loader Work Assignment And Clock Out

3.1 Page surfaces

Current pages:

inbound-planning
inbound-loader

Current page source still uses numeric compatibility checks.

Inbound Planning includes conditions equivalent to:

Forklift role = numeric role 4
CTC office = CLIENT_ID 1 and numeric role in 1,2,3

Inbound Loader also identifies Forklift Operator through numeric role 4.

These checks are UI/page compatibility behavior. They are not the same authority used by the current API handlers.

3.2 Route metadata

Current Work Assignment routes declare:

moduleKey = tms.transload

They do not declare a dedicated requiredMenuRoutes, requiredRoleIds or strict tenant principal at route registration.

Current routes:

POST   /tms/transloads/work-assignments
GET    /tms/transloads/work-assignments
GET    /tms/transloads/work-assignments/current
POST   /tms/transloads/work-assignments/{id}/start
POST   /tms/transloads/work-assignments/{id}/complete
DELETE /tms/transloads/work-assignments/{id}
POST   /tms/transloads/work-assignments/{id}/advance-clock-out
POST   /tms/transloads/work-assignments/{id}/clock-out

3.3 Handler actor predicates

Manager actions use:

staff_time_can_manage()

That helper resolves current role names and allows names containing:

ADMINISTRATOR
OFFICE MANAGER
MANAGER

Current manager authorization is therefore role-name based, while some page visibility is numeric-role and numeric-tenant based.

Loader actions use:

assigned loader user
OR
staff_time_can_manage()

The current current query resolves the effective staff user and returns only that Loader's queue projection.

3.4 Record and state predicates

Current record identity includes:

CLIENT_ID
T_LOADING_PLANNER.ID
SPECIAL_INSTRUCTION = QUEUE_WORK_ASSIGNMENT
LOADER_NAME as assigned staff identity

Current state checks include:

create/list/cancel = manager predicate
start = SCHEDULED + assigned loader/manager + clocked in + no open break + no competing active work
complete = STARTED + non-Clock-Out assignment
advance-clock-out = STARTED Clock Out + cleaning required
clock-out = STARTED Clock Out + prerequisite state
cancel = SCHEDULED only

3.5 Current mismatch to verify

UI/page gate:
numeric CLIENT_ID and numeric role

API manager gate:
role-name substring

API Loader gate:
effective assigned user or manager

This can produce:

• a control hidden from an otherwise API-authorized manager;
• a page visible to a role that the handler does not regard as manager;
• an API route reachable through a direct request even when the normal page hides the action;
• different results after role renaming or multi-role assignment.

The source refresh records the mismatch. It does not claim a current user has exploited or encountered it.

---

4. Street Turn Create And Revert

4.1 Split module ownership

Street Turn is one bounded operational capability with two different route-module owners.

Create:
POST /yms/containers/street-turn
moduleKey = yms.container-tracking

Revert:
POST /tms/export-containers/revert
moduleKey = tms.booking

Neither route declares dedicated action-role metadata at registration.

4.2 Create handler predicates

The create handler revalidates:

same tenant
exact equipment load and equipment relation
source load status EMPTY
active equipment
supported size
active EXPORT booking
same shipping line
positive quantity for the equipment size
cutoff not expired

It then changes the source load, creates the generated export load and marks the container Street Turn AVAILABLE in one local transaction.

4.3 Revert handler predicates

The revert handler requires:

exact equipment ID
exact generated export equipment-load ID
generated load remains open and EMPTY
container remains STREET_TURN_STATUS = AVAILABLE
no Delivery history
no Transload history
matching preceding RETURNED import load
conditional one-row updates

These are strong record/state predicates but not an explicit action-role contract.

4.4 Current access question

The current effective authority is approximately:

page/menu/module access
+ UI state visibility
+ direct API module guard
+ record/state predicates

A dedicated create Street Turn or reverse Street Turn permission was not located in current source.

Because create and revert are registered under different modules, granting one module does not semantically prove the actor should have both actions.

---

5. Final Loading Review

5.1 Page and route surface

Current page:

inventory-adjustment

Current API family:

GET  /wms/inventory/bale-reviews
POST /wms/inventory/bale-reviews/confirm
POST /wms/inventory/bale-reviews/apply-weight
POST /wms/inventory/bale-reviews/update-outbound
POST /wms/inventory/bale-reviews/reopen
POST /wms/inventory/bale-reviews/bulk-confirm

All routes declare:

moduleKey = wms.inventory

No dedicated route-role metadata is declared for these actions.

5.2 Current actor predicate

Write handlers call:

wmsInventoryAssertSpareBaleOffice()

Current behavior:

CLIENT_ID = 1
-> allow only numeric role 1,2,3

CLIENT_ID != 1
-> return without an explicit role restriction

This is a direct numeric-tenant compatibility branch in an action-authorization helper.

5.3 Record and state authority

The domain helpers own state eligibility for:

Pending review correction
Use Inbound Weight
Source/Leftover/Weight adjustment
Confirm
Bulk Confirm
Reopen
Confirmed-state mutation protection

The page renders the operational controls and depends on API denial for enforcement. Therefore control visibility cannot be treated as the security boundary.

5.4 Current access risk classification

Client 1:
explicit numeric office-role restriction

Other tenants:
module + tenant-scoped record/state guards
but no equivalent explicit role predicate in this helper

This is a source-level policy asymmetry requiring current tenant/role evidence. It is not permission to copy the Client 1 numeric rule to all tenants.

---

6. AR Billing, QBO, Files And Email

6.1 AR Billing and QBO routes

Current AR Billing routes declare moduleKey = bms.transaction but no dedicated action-role metadata for:

read options/presets/rates/workbench
create/update/delete presets
edit company rates
preview
confirm local container AR
QBO sync

Handler-level business validation protects schema, tenant, source, rate and QBO state. It does not define an accepted operational-role matrix.

The historical migration seeded menu roles broadly, but current installed menu rows and role assignments have not been read in this documentation lane.

6.2 BOL email

POST /tms/transloads/{id}/bol-email
moduleKey = tms.transload

Current handler validates the tenant-scoped Transload, recipient and attachment construction, then performs a Gmail send. No dedicated route-role predicate was located.

6.3 Packing List email

POST /tms/bookings/{id}/packing-list/email
moduleKey = tms.booking

Current handler validates booking/report mode, recipients, document prerequisites and attachment batches, then sends target/part messages. No dedicated route-role predicate was located.

6.4 Consequential-action boundary

The following actions must not be treated as ordinary module availability:

confirm local AR
send/create QBO invoice
create/update/delete Billing preset
edit Billing rate
send BOL email
send Packing List target/part email

Current source freshness for these owner files has been refreshed separately. Current actor-role acceptance remains unverified.

---

7. Current Decision Composition

For the reviewed surfaces, the effective decision is distributed.

Layer	Current source
Authentication	session/API bootstrap
Tenant	legacy/effective context plus tenant-scoped SQL
Module	route moduleKey
Page/menu	shell, current T_MENU, module-page and page route
Action actor	role-name helper, numeric tenant/role helper, assigned-user predicate, or not explicitly declared
Record	tenant ID plus owner-specific ID/relation query
State	owning workflow helper
External effect	QBO/Gmail or none

No reviewed action should be described only as:

module enabled = action allowed

---

8. Candidate Semantic Action Names

The following names are documentation and migration inputs only. They are not an implemented registry.

tms.work-assignment.manage
tms.work-assignment.self

yms.street-turn.create
tms.street-turn.reverse

wms.final-review.read
wms.final-review.correct
wms.final-review.confirm
wms.final-review.reopen

bms.ar-billing.read
bms.ar-billing.manage
bms.qbo.deliver

tms.bol.send
tms.packing-list.send

Each future semantic action must retain the owning record/state predicate. A semantic capability cannot replace workflow eligibility.

---

9. Required Current Evidence

The current action matrix cannot be accepted without:

current T_MENU and T_MODULE_PAGE rows
current T_TENANT_MODULE state
current role names and numeric IDs
current controlled role accounts
page/menu findability
GET page/initial-read behavior
visible/hidden action controls
allowed direct action behavior in a non-mutating fixture or explicitly authorized disposable fixture
expected denial with no mutation
foreign-tenant reference denial
record-state denial
Client 1 non-regression
selected Client 2 expected behavior

Evidence package:

RBR-ACCESS-001

---

10. Safe Interpretation

Current findings establish:

core access infrastructure unchanged
+ operational action surface expanded
+ authorization remains distributed
+ several routes are module-only at registration
+ handler actor predicates are inconsistent in form
+ numeric tenant/role compatibility remains
+ current environment evidence is missing

They do not establish:

all current roles are over-permitted
all current roles are under-permitted
an active tenant isolation breach
a safe universal replacement policy
a safe default-deny rollout
M3 or M4

---

11. Current Disposition

Static current-surface refresh:
COMPLETE

Core infrastructure freshness:
CONFIRMED UNCHANGED

Operational route/action inventory:
CURRENT SOURCE-RECONCILED INPUT

Current DB/menu/role/account evidence:
NOT RUN

Current browser/API role evidence:
NOT RUN

Accepted semantic capability policy:
OPEN

Implementation:
USER HOLD

M3:
NO

M4:
NO

---

Source: docs/reconstruction/PLATFORM_AUTHORIZATION_CURRENT_SURFACE_REFRESH_2026-08-08.md — ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged.