#1143 Replace stale permission TODO in query/carve target resolution Pull request opened by javuto Replace stale permission TODO in query/carve target resolution Problem

CreateQueryCarve

in

pkg/handlers/handlers.go

had a

TODO: Check if user has permissions to query the environment

in the environment-target loop. It made the code look like there was a hole in environment authorization. Change Comment only, no behavior change. The TODO now states the actual contract: callers must check each target environment's permissions before calling this function. Why that's safe today: • API:

QueriesRunHandler

and

CarvesRunHandler

pass every requested environment through

authorizeTargetEnvs

(

cmd/api/handlers/queries.go

), which checks the query or carve permission level for each one before

CreateQueryCarve

runs. • Other targets: platform, UUID, hostname and tag targets are all looked up only inside the environment in the URL, which the handler has already checked. • CLI: it has direct database access and is trusted by design. Security / operational impact None. This documents existing authorization behavior. Validation • Existing coverage:

TestRunTargetEnvironmentsAuthorizedByUUID

asserts both queries and carves get a 403 for an environment the user can't access, and a 404 for one that doesn't exist. •

go test ./pkg/handlers ./cmd/api/handlers

(targeted tests): pass • `gofmt`: clean jmpsec/osctrl