fix(auth,jobs): 13 undeclared admin endpoints, a 500 on an unknown id, and two dead seams

[rubenvdlinde]

Measured at gate package 365fa31 with NODE_PATH set — require.resolve('ajv') → /home/rubenlinde/nextcloud-docker-dev/workspace/server/node_modules/ajv/dist/ajv.js. Every run had a 0-byte .err; verdicts read from stdout, never the exit byte.

gate	before	after
3 stub-scan	1	0
5 route-auth	13	0
9 semantic-auth	1	0
18 notification-dialect	WARNING	PASS
49 controller-exception-translation	1	0
57 orphaned-write-capability	2	0
full-repo failing gates	19	14

Thirteen admin endpoints that declared nothing (gate-5)

Audit-log query, governance reports, multilingual reconciliation and regulator export all call requireAdmin() in the body but carried no auth attribute at all. Nextcloud treats "no attribute" as admin-required, so they worked — but "deliberately admin-only" and "someone forgot" look identical in the source. AuditLogController's own class docblock had already noticed, warning that the absence "is silently bypassed in some test setups".

They now carry #[AuthorizedAdminSetting(AdminSettings::class)] — this repo's existing, live idiom for an admin-only REST endpoint (MemberImportController, SettingsController), not a new invention. It additionally lets an admin delegate these to a group rather than hardcoding "is a server admin". Body guards kept as defence in depth.

#[NoCSRFRequired] would also have satisfied gate-5. It was not used: it says nothing about admin and would have weakened CSRF protection to quiet a checker.

publish() said the opposite of what it did (gate-9)

It carried #[NoAdminRequired] — "any authenticated user" — while the next statements refuse non-administrators and its own docblock said "Requires Nextcloud admin role". The attribute is what a reader, an auditor and the middleware all see first.

getStats 500'd on an unknown participant (gate-49)

OpenRegister's find() throws DoesNotExistException; it does not return null. The !== null branch was unreachable for the case it was written for, and the exception escaped as a 500 on an ordinary "no such participant" request — the same defect class as ParticipantResolver, fixed in #425.

An absent participant now answers 403, deliberately fail-closed: a 404 would let any authenticated user enumerate participant UUIDs. The service call translates DoesNotExist → 404 and InvalidArgument → 400.

A third test asserts a RuntimeException still propagates. Narrowing an exception type is only a fix if the narrowing is real — a blanket catch would turn an OpenRegister outage into a tidy 403 and hide it from monitoring.

Nobody was ever told a decision went public (gate-57 + gate-18)

DecisionNotificationService::notifyOnPublish had zero callers, zero tests and no DI registration, and isPublished was the one Decision event with no declarative rule — so the notification simply never happened. ADR-031 keeps notifications declarative and gate-18 flagged the class by name, so the rule lands in the register as decisionPublished (mirroring its six siblings) and the dead imperative class is removed rather than wired up.

createPreference was a second name for one write (gate-57)

A self-described "(alias)" delegating to updatePreference, which is itself an upsert. No callers in lib/, src/ or tests/ — nothing wrote through it, so nothing can be orphaned by its removal.

A retired job that could never retire (gate-3)

OverdueActionItemsJob was emptied to a no-op with a comment saying it was kept "so the registered oc_jobs row reaps cleanly" — while still declared in appinfo/info.xml, so Nextcloud re-registered it on every app update and cron ran an empty job every 24 hours, forever. Both halves are removed.

No repair step is needed. Read from the running server's own lib/private/BackgroundJob/JobList.php::buildJob(): an unresolvable job class is logged and then dropped via removeById() — "Remove job from disabled app or old version of an app". Measured, not assumed; a repair step was written first and deleted once the source said it was redundant.

Can-fail proof

One item reverted at a time, each gate required to name it:

gate	named on revert
5	AuditLogController.php:126 method=verify rule=missing-auth-attribute
9	DecisionController.php:225 method=publish rule=no-admin-required-annotation-with-admin-body
57	NotificationPreferenceService.php:194 method=createPreference
49	removing the catch makes the new test error with the escaping DoesNotExistException — the live 500, reproduced

All restored; all back to PASS.

Other checks

phpunit 826 / 3009 assertions / 0 failures (823 + 3 new, minus the 5 belonging to the deleted job) · phpcs 0 errors, 98 warnings · phpstan 0 · psalm 0 · phpmd 0 on both rulesets.

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/decidesk @ 568abe7

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
composer			✅	✅ 100/100
npm			✅	✅ 549/549
PHPUnit					✅
Newman					❌
Playwright					❌
Hydra gates					❌

---

Quality workflow — 2026-08-09 21:08 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/decidesk @ 3a95b3b

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
composer			✅	✅ 100/100
npm			✅	✅ 549/549
PHPUnit					✅
Newman					❌
Playwright					❌
Hydra gates					✅

---

Quality workflow — 2026-08-09 21:46 UTC

Download the full PDF report from the workflow artifacts.