SUM-SEC-12 [P1][12/20][Med] Audited elevated context and ban HTTP bypass

[CHINMAYVIVEK]

ID: SUM-SEC-12
Wave: P1
Severity: Medium
Labels: security, bypass, acl, P1, medium
Branch: fix/SUM-SEC-12-elevated-bypass-audit-lint
Languages: Go
Related: SUM-PLAT-03 (API shape / product)
CWE: CWE-250

Summary

ContextWithBypass is unscoped and largely unaudited. Web layer does not set it on requests today (good). Addon hooks (automation, digest), scheduler, outbox, module sync elevate silently. Foot-gun: wrapping r.Context() with bypass skips ACL/rules/field ACL for the whole request. superuserUID = 1 is a second total bypass path.

Acceptance criteria

• WithElevated(ctx, reason, fn) with audit event (actor, reason, models touched if feasible)
• Lint or grep CI: no ContextWithBypass outside allowlisted core/ packages; never on HTTP r.Context() in handlers
• Document uid=1 break-glass; prefer capability/group over numeric id long-term
• Inventory existing callers migrated

Files to check / change

• sumeru/core/orm/security_context.go
• sumeru/core/orm/security_const.go
• Callers: setup_handlers.go, module/*, scheduler.go, outbox_drain.go, addons/automation/hooks.go, addons/digest/hooks.go, apikey.go