ismail
102963b4be
All checks were successful
Build and Push Docker Image / build (push) Successful in 24s
Comprehensive role × action permission matrix test. Key findings: 1. source_user: 0/20 blocks — ALL main app views accessible (should be restricted) 2. config_dashboard: accessible by ALL roles (should be px_admin only) 3. Many POST actions return 302 (redirect with error) instead of 403 when blocked — the action is actually denied but HTTP status looks like success. This is a design pattern (catch PermissionDenied → redirect with message). 4. physician/nurse/staff/viewer can reach complaint_change_status, inquiry_respond, observation_change_status, action_create, project_create — these may be real gaps OR the 302-redirect pattern (need state-based verification). The test surfaces both real RBAC gaps and areas where the redirect-instead-of-403 pattern makes HTTP-status-based detection unreliable.