azurenoops / azurenoops/spin_agent
[BUG-25] RBAC implemented via manual HashSet — authorization logic fragile and untestable
- Dominant language
- C#
- Stars
- 3
- Forks
- 1
- Avg merge
- 18h 9m
- Merged PRs (30d)
- 43
Description
## BUG-25 — RBAC Implemented via Manual HashSet
**Category:** Bug — MCP Code | **Priority:** Medium
### Observation
Role-Based Access Control is implemented via manual HashSet comparisons rather than a structured authorization framework. This is fragile, hard to audit, and difficult to test.
### Evidence
- Issue #636 — RBAC via manual HashSet (O3 finding)
### Impact
Authorization logic is brittle. Adding roles or permissions requires code changes with no policy abstraction. Misconfigurations are easy and hard to detect. Authorization cannot be audited or tested systematically.
### Acceptance Criteria
- [ ] RBAC replaced with a structured authorization policy framework (e.g., policy-based authorization)
- [ ] Roles and permissions defined declaratively
- [ ] Authorization decisions testable via unit tests
- [ ] RBAC configuration auditable without reading application code
Contributor guide
Assessment
This issue has not been assessed yet.