Repository navigation
TIGER-359: authenticated 403 → redirect to dashboard + log the attempt - #347
Merged
Merged
Conversation
…t (v1.29.0)
A signed-in user who reached a page above their role got the themed 403 wall ("You don't have
access to that", Back to home / Switch account) — wrong UX for someone who just clicked something
above their role. Now Tiger_Controller_Plugin_Authorization::_deny(), for an authenticated-but-
forbidden caller, LOGS the attempt (Tiger_Log::warn('acl.denied', {resource,action,path,role}),
auto-enriched with user/org/role) and REDIRECTS to their own dashboard instead of rendering a 403.
- New Tiger_Service_Authentication::homeFor($identity) — one authority for the identity's dashboard
(/admin for admin-class roles, else /account), shared by AuthController::_roleHome() and the gate.
- Loop guard: if the forbidden resource IS the caller's dashboard, fall back to the themed 403 (no
redirect loop). Guests still → /auth/login, locked → /auth/lock, unchanged. The themed 403 page
remains for the loop-guard fallback + direct error dispatches.
- Tests: homeFor + _forbiddenRedirect decision logic (sibling AuthorizationPluginTest) and the
loop-guard 403 fallback (AuthorizationPluginExtraTest, old 403-forward test retargeted). Full suite
green: 1128 unit + 1481 integration.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ASauLLscjqdsNqBNsx2Typ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
A signed-in user who hits a page above their role currently gets a full-page themed 403 (lock icon, "You don't have access to that", Back to home / Switch account). That's the wrong UX for someone who merely clicked something above their role.
Now
Tiger_Controller_Plugin_Authorization::_deny(), for an authenticated-but-forbidden caller:Tiger_Log::warn('acl.denied', {resource, action, path, role})(auto-enriched with user/org/request_id).Tiger_Service_Authentication::homeFor():/adminfor an admin-class role, else/account.Guests still →
/auth/login, a locked screen still →/auth/lock(unchanged). A loop guard falls back to the themed 403 only when the forbidden resource is the caller's own dashboard, so no redirect loop can form. The themed 403 page stays for that fallback + direct error dispatches.Design
homeFor()is a single authority shared byAuthController::_roleHome()(login landing) and the gate, so "where does this person belong" is answered the same way everywhere. The redirect decision is extracted into a testable_forbiddenRedirect()(the full redirect path callsgotoUrlAndExit, a real process exit, so its target is pinned by unit assertions).Tests
homeFor+_forbiddenRedirectdecision logic (AuthorizationPluginTest) and the loop-guard 403 fallback + theacl.deniedaudit (AuthorizationPluginExtraTest, old 403-forward test retargeted). Full suite green locally: 1128 unit + 1481 integration.🤖 Generated with Claude Code
https://claude.ai/code/session_01ASauLLscjqdsNqBNsx2Typ