fix(gate-9): the admin rule matched no real isAdmin() call, and prose bought the self-auth exemption

[rubenvdlinde]

Found while clearing two gate-9 findings on openconnector development. Both findings were false positives; chasing why turned up a third, larger problem underneath.

1. The admin rule has never matched a real guard

no-admin-required-annotation-with-admin-body tested the if condition with:

re.search(r"\bisAdmin\b[^)]*===\s*false", cond)

isAdmin() is essentially always called with a UID — $this->groupManager->isAdmin($this->userId) === false — and that ) stops [^)]* before the comparison. It is the same over-restrictive character class as the [^}]* body regex this module was written to replace (W28).

The condition slice is already bounded by its own matching paren, so .*? cannot run past the condition. The Yoda form (false === …isAdmin(…)) is matched too.

That one character class was hiding 25 findings across 10 repos — #[NoAdminRequired] on methods that enforce admin in the body, i.e. endpoints whose attribute states the opposite of what they do. Every run of this gate reported PASS on all of them. Sampled and confirmed real:

repo	method
openregister	FederatedConfigController::trust, ::setTrust, CredentialController::registerApp
softwarecatalog	SettingsController ×8
pipelinq	CtiController ×4, NotesController::deleteAll, CallbackController::reassign, KassakoppelingAuditController::export
procest	RoutingController::reroute, InspectionChecklistController::submitResult
larpingapp, decidesk, hrmq, openbuild	1 each

2. Prose bought the self-auth exemption

_SELF_AUTH_RE was matched against raw source, so a docblock reading "callers must present a bearer token" exempted a method containing no such check — the 2026-08-06 gate-64 shape, where a commented-out call counted as a real one. Now matched against comment-stripped source.

Comments only, not string literals. 'Bearer ', 'HTTP_AUTHORIZATION' and the header name handed to getHeader() live in literals in every real handler; blanking those would manufacture exactly the false positives this gate was rewritten to stop.

3. Two endpoints were passing only because of (2)

hermiq McpRunController::handle and EgressAuthorizeController::authorize resolve their credential via a helper passed as a named argument:

$binding = $this->runTokenService->verify(token: $this->bearerToken());

Neither bearerToken() nor token: was in the six-verb pattern list — the only thing matching was the word bearer in their own comments. Fixing (2) alone would have turned two correct endpoints red. Widened to any ->…Token…( call and to named credential arguments.

Plus: a password is a credential

A login endpoint is #[PublicPage] by necessity — the caller has no session yet, that is what it is asking for — and answers 401 when the password is wrong. openconnector UserController::login resolves $username/$password from the request and calls checkPassword() in its body, and the token-only list still called it an unsourced denial. There was no correct action a developer could take on that finding, which is the standard this gate already sets for itself.

Measured impact

Old gate vs new, over 761 fleet controllers:

• 2 false positives removed — openconnector UserController::login, hermiq McpRunController::handle
• 25 previously invisible true positives revealed

Repos go red only where their diff touches those files (ADR-020 diff scoping).

Tests

The module shipped with none. test_check_semantic_auth.py is picked up automatically by the discovery runner — 21 assertions, 9 of them failure-demonstrating: every exemption is paired with the same PHP shape minus the one thing that earns it, so the suite cannot go quiet by accident. Three tests pin (2) and (3) against each other — prose must not exempt, literals must still count, and a // inside a URL must not swallow the rest of the method.

Full helper-suite run: 26 passed, 2 quarantined as documented, 0 failed.