security/platform: close audit findings #19–#26

Tests, CSP nonce middleware, SSRF guard, perf-route hardening, Docker env isolation, migration runbook, RBAC E2E coverage. Tickets resolved: - #19: MfaSetup.test.ts — static source tests confirming local QR rendering - #20: ssrf-guard.test.ts (16 tests) + webhook-procedure-support mock fix - #21: /api/perf route.test.ts (5 tests) — header-only auth, fail-closed - #22: middleware.ts (nonce-based CSP) + middleware.test.ts (6 tests); layout.tsx async + nonce prop; CSP removed from next.config.ts - #23: Active-session registry enforcement verified (already in codebase) - #24: docker-compose.yml REDIS_URL hardcoded (no host-env substitution) - #25: docker-compose.yml REDIS_URL + docs/developer-runbook.md created - #26: e2e/dev-system/rbac-data-access.spec.ts (12 tests, 3 roles × 4 procedures) Quality gates: tsc clean, api 1447/1447, web 189/189 passing. Turbo concurrency capped at 2 (package.json) to prevent OOM under parallel test runs. Co-Authored-By: claude-flow <ruv@ruv.net>
2026-04-01 22:14:20 +02:00
parent 4901bc878b
commit bfdf0a82da
15 changed files with 1013 additions and 23 deletions
@@ -16,13 +16,26 @@ export async function signIn(page: Page, email: string, password: string) {
 }

 export async function signOut(page: Page) {
-  await page.goto("/auth/signout");
-  // Auth.js v5 renders a confirmation page at /auth/signout before signing out.
-  // Click the submit button if a form is present.
-  const confirmBtn = page.locator('button[type="submit"]').first();
-  if (await confirmBtn.isVisible({ timeout: 3000 }).catch(() => false)) {
-    await confirmBtn.click();
-  }
+  // next-auth/react signOut() POSTs to /auth/signout with a CSRF token.
+  // There is no GET-accessible signout page in this app (/auth/signout returns 404).
+  // Replicate what the client-side signOut() function does:
+  // 1. Fetch the CSRF token from /auth/csrf
+  // 2. POST to /auth/signout with that token
+  // 3. Follow the redirect to /auth/signin
+  await page.goto("/dashboard"); // land on any authenticated page for cookie context
+  await page.evaluate(async () => {
+    const csrfRes = await fetch("/api/auth/csrf");
+    const { csrfToken } = await csrfRes.json() as { csrfToken: string };
+    await fetch("/api/auth/signout", {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ csrfToken, callbackUrl: "/auth/signin", json: "true" }),
+      redirect: "follow",
+    });
+  });
+  // After the POST clears the session cookie, navigating to a protected route
+  // should redirect to sign-in.
+  await page.goto("/dashboard");
  await page.waitForURL(/\/auth\/signin/, { timeout: 10000 });
 }

@@ -0,0 +1,239 @@
+/**
+ * RBAC data-access matrix — dev system
+ *
+ * Verifies that role-based access control is enforced at the network level
+ * (tRPC response payload) against the running dev server with real seed data.
+ *
+ * Unlike rbac-permissions.spec.ts (which checks UI visibility), these tests
+ * call tRPC procedures directly via fetch() inside the browser context and
+ * assert on HTTP status + tRPC error codes in the response body.
+ *
+ * All tests use pre-authenticated storage states — no signIn() calls, no
+ * auth rate limiter pressure. 3 logins total per suite run (from globalSetup).
+ *
+ * Tested procedures and their audience classes (docs/route-access-matrix.md):
+ *
+ *   user.list            → admin-only     (adminProcedure)
+ *   allocation.listView  → planning-read  (planningReadProcedure → VIEW_PLANNING)
+ *   resource.listSummaries → resource-overview (resourceOverviewProcedure)
+ *   user.listAssignable  → manager-write  (managerProcedure → ADMIN or MANAGER)
+ *
+ * Expected access matrix:
+ *
+ *   Procedure               ADMIN  MANAGER  VIEWER
+ *   user.list               ✓      FORBIDDEN FORBIDDEN
+ *   allocation.listView     ✓      ✓        FORBIDDEN
+ *   resource.listSummaries  ✓      ✓        FORBIDDEN
+ *   user.listAssignable     ✓      ✓        FORBIDDEN
+ */
+import { expect, test, type Page } from "@playwright/test";
+import { STORAGE_STATE } from "../../playwright.dev.config.js";
+
+// ---------------------------------------------------------------------------
+// Helper — call a tRPC query procedure directly from within the browser context
+// ---------------------------------------------------------------------------
+
+type TrpcQueryResult = {
+  httpStatus: number;
+  trpcCode: string | null;
+  hasData: boolean;
+};
+
+/**
+ * Runs a tRPC GET query inside the browser context (inherits the session cookie).
+ * Returns the HTTP status, the tRPC error code (null on success), and whether
+ * a non-null `result.data` was returned.
+ *
+ * tRPC v11 batch GET format:
+ *   /api/trpc/<proc>?batch=1&input={"0":{"json":<input>}}
+ * Success response:  [{"result":{"data":{"json": ...}}}]
+ * Error response:    [{"error":{"json":{"data":{"code":"FORBIDDEN","httpStatus":403}}}}]
+ */
+async function trpcQuery(
+  page: Page,
+  procedure: string,
+  input: unknown = null,
+): Promise<TrpcQueryResult> {
+  return page.evaluate(
+    async ({ procedure, input }) => {
+      const encodedInput = encodeURIComponent(
+        JSON.stringify({ "0": { json: input } }),
+      );
+      const url = `/api/trpc/${procedure}?batch=1&input=${encodedInput}`;
+      const res = await fetch(url, { credentials: "include" });
+      const httpStatus = res.status;
+
+      // tRPC v11 with no transformer: no extra .json wrapper around the payload.
+      // Error format: [{"error":{"message":"...","code":-32603,"data":{"code":"FORBIDDEN","httpStatus":403}}}]
+      // Success format: [{"result":{"data": <value>}}]
+      type TrpcBatchItem = {
+        result?: { data?: unknown };
+        error?: { data?: { code?: string }; message?: string };
+      };
+      const body = (await res.json()) as TrpcBatchItem[];
+      const item = body[0];
+      const trpcCode = item?.error?.data?.code ?? null;
+      const hasData =
+        item?.result?.data !== undefined && item.result.data !== null;
+
+      return { httpStatus, trpcCode, hasData } satisfies {
+        httpStatus: number;
+        trpcCode: string | null;
+        hasData: boolean;
+      };
+    },
+    { procedure, input },
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Admin — should have access to all procedures
+// ---------------------------------------------------------------------------
+
+test.describe("RBAC data-access — admin", () => {
+  test.use({ storageState: STORAGE_STATE.admin });
+
+  test("admin: user.list returns data (admin-only procedure)", async ({
+    page,
+  }) => {
+    await page.goto("/dashboard");
+    await page.waitForLoadState("networkidle");
+
+    const result = await trpcQuery(page, "user.list");
+    expect(result.trpcCode).toBeNull();
+    expect(result.httpStatus).toBe(200);
+    expect(result.hasData).toBe(true);
+  });
+
+  test("admin: allocation.listView returns data (planning-read)", async ({
+    page,
+  }) => {
+    await page.goto("/dashboard");
+    await page.waitForLoadState("networkidle");
+
+    const result = await trpcQuery(page, "allocation.listView", {});
+    expect(result.trpcCode).toBeNull();
+    expect(result.httpStatus).toBe(200);
+  });
+
+  test("admin: resource.listSummaries returns data (resource-overview)", async ({
+    page,
+  }) => {
+    await page.goto("/dashboard");
+    await page.waitForLoadState("networkidle");
+
+    const result = await trpcQuery(page, "resource.listSummaries");
+    expect(result.trpcCode).toBeNull();
+    expect(result.httpStatus).toBe(200);
+  });
+
+  test("admin: user.listAssignable returns data (manager-write procedure)", async ({
+    page,
+  }) => {
+    await page.goto("/dashboard");
+    await page.waitForLoadState("networkidle");
+
+    const result = await trpcQuery(page, "user.listAssignable");
+    expect(result.trpcCode).toBeNull();
+    expect(result.httpStatus).toBe(200);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Manager — FORBIDDEN on admin-only, allowed on planning-read/resource-overview/manager
+// ---------------------------------------------------------------------------
+
+test.describe("RBAC data-access — manager", () => {
+  test.use({ storageState: STORAGE_STATE.manager });
+
+  test("manager: user.list is FORBIDDEN (admin-only procedure)", async ({
+    page,
+  }) => {
+    await page.goto("/dashboard");
+    await page.waitForLoadState("networkidle");
+
+    const result = await trpcQuery(page, "user.list");
+    expect(result.trpcCode).toBe("FORBIDDEN");
+  });
+
+  test("manager: allocation.listView returns data (planning-read)", async ({
+    page,
+  }) => {
+    await page.goto("/dashboard");
+    await page.waitForLoadState("networkidle");
+
+    const result = await trpcQuery(page, "allocation.listView", {});
+    expect(result.trpcCode).toBeNull();
+    expect(result.httpStatus).toBe(200);
+  });
+
+  test("manager: resource.listSummaries returns data (resource-overview)", async ({
+    page,
+  }) => {
+    await page.goto("/dashboard");
+    await page.waitForLoadState("networkidle");
+
+    const result = await trpcQuery(page, "resource.listSummaries");
+    expect(result.trpcCode).toBeNull();
+    expect(result.httpStatus).toBe(200);
+  });
+
+  test("manager: user.listAssignable returns data (manager-write procedure)", async ({
+    page,
+  }) => {
+    await page.goto("/dashboard");
+    await page.waitForLoadState("networkidle");
+
+    const result = await trpcQuery(page, "user.listAssignable");
+    expect(result.trpcCode).toBeNull();
+    expect(result.httpStatus).toBe(200);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Viewer — FORBIDDEN on all sensitive procedures
+// ---------------------------------------------------------------------------
+
+test.describe("RBAC data-access — viewer", () => {
+  test.use({ storageState: STORAGE_STATE.viewer });
+
+  test("viewer: user.list is FORBIDDEN (admin-only procedure)", async ({
+    page,
+  }) => {
+    await page.goto("/dashboard");
+    await page.waitForLoadState("networkidle");
+
+    const result = await trpcQuery(page, "user.list");
+    expect(result.trpcCode).toBe("FORBIDDEN");
+  });
+
+  test("viewer: allocation.listView is FORBIDDEN (planning-read — no VIEW_PLANNING)", async ({
+    page,
+  }) => {
+    await page.goto("/dashboard");
+    await page.waitForLoadState("networkidle");
+
+    const result = await trpcQuery(page, "allocation.listView", {});
+    expect(result.trpcCode).toBe("FORBIDDEN");
+  });
+
+  test("viewer: resource.listSummaries is FORBIDDEN (resource-overview)", async ({
+    page,
+  }) => {
+    await page.goto("/dashboard");
+    await page.waitForLoadState("networkidle");
+
+    const result = await trpcQuery(page, "resource.listSummaries");
+    expect(result.trpcCode).toBe("FORBIDDEN");
+  });
+
+  test("viewer: user.listAssignable is FORBIDDEN (manager-write procedure)", async ({
+    page,
+  }) => {
+    await page.goto("/dashboard");
+    await page.waitForLoadState("networkidle");
+
+    const result = await trpcQuery(page, "user.listAssignable");
+    expect(result.trpcCode).toBe("FORBIDDEN");
+  });
+});
@@ -28,14 +28,8 @@ const nextConfig: NextConfig = {
          { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
          { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
          { key: "Strict-Transport-Security", value: "max-age=31536000; includeSubDomains" },
-          {
-            key: "Content-Security-Policy",
-            value: process.env.NODE_ENV === "production"
-              // Production: no unsafe-eval, no unsafe-inline in script-src
-              ? "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' https://generativelanguage.googleapis.com https://*.openai.com https://*.azure.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'"
-              // Development: allow unsafe-eval and unsafe-inline for HMR / dev tooling
-              : "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https://generativelanguage.googleapis.com https://*.openai.com https://*.azure.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'",
-          },
+          // Content-Security-Policy is set per-request by middleware.ts (nonce-based).
+          // Static CSP here would conflict and cannot carry per-request nonces.
          { key: "X-XSS-Protection", value: "0" },
        ],
      },
@@ -0,0 +1,88 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@capakraken/api/sse", () => ({
+  eventBus: { subscriberCount: 0 },
+}));
+
+// Lazy import so we can stub env before the module-level code runs.
+const importRoute = () => import("./route.js");
+
+describe("GET /api/perf — security hardening", () => {
+  const ORIGINAL_SECRET = process.env["CRON_SECRET"];
+
+  beforeEach(() => {
+    vi.resetModules();
+  });
+
+  afterEach(() => {
+    if (ORIGINAL_SECRET === undefined) {
+      delete process.env["CRON_SECRET"];
+    } else {
+      process.env["CRON_SECRET"] = ORIGINAL_SECRET;
+    }
+  });
+
+  it("returns 200 with metrics for an authorised request via Authorization header", async () => {
+    process.env["CRON_SECRET"] = "test-secret-abc";
+    const { GET } = await importRoute();
+
+    const request = new Request("http://localhost/api/perf", {
+      headers: { Authorization: "Bearer test-secret-abc" },
+    });
+
+    const response = await GET(request);
+    expect(response.status).toBe(200);
+
+    const body = await response.json() as { timestamp: string; uptime: unknown; memory: unknown };
+    expect(typeof body.timestamp).toBe("string");
+    expect(body.uptime).toBeDefined();
+    expect(body.memory).toBeDefined();
+  });
+
+  it("returns 401 when no Authorization header is provided", async () => {
+    process.env["CRON_SECRET"] = "test-secret-abc";
+    const { GET } = await importRoute();
+
+    const request = new Request("http://localhost/api/perf");
+    const response = await GET(request);
+    expect(response.status).toBe(401);
+  });
+
+  it("returns 401 when the Authorization header contains a wrong secret", async () => {
+    process.env["CRON_SECRET"] = "test-secret-abc";
+    const { GET } = await importRoute();
+
+    const request = new Request("http://localhost/api/perf", {
+      headers: { Authorization: "Bearer wrong-secret" },
+    });
+    const response = await GET(request);
+    expect(response.status).toBe(401);
+  });
+
+  it("returns 401 for a query-param token — query-string auth is not supported", async () => {
+    process.env["CRON_SECRET"] = "test-secret-abc";
+    const { GET } = await importRoute();
+
+    // Pass secret as query param only — no Authorization header
+    const request = new Request("http://localhost/api/perf?token=test-secret-abc");
+    const response = await GET(request);
+    // The endpoint ignores query params entirely; without a valid header it must reject.
+    expect(response.status).toBe(401);
+  });
+
+  it("returns 401 and leaks no metrics when CRON_SECRET is not configured (fail-closed)", async () => {
+    delete process.env["CRON_SECRET"];
+    const { GET } = await importRoute();
+
+    // Even a request that would otherwise be valid must be rejected.
+    const request = new Request("http://localhost/api/perf", {
+      headers: { Authorization: "Bearer anything" },
+    });
+    const response = await GET(request);
+    expect(response.status).toBe(401);
+
+    const body = await response.json() as { error?: string; timestamp?: string; memory?: unknown };
+    expect(body.timestamp).toBeUndefined();
+    expect(body.memory).toBeUndefined();
+  });
+});
@@ -7,7 +7,9 @@ export const runtime = "nodejs";
 /**
 * GET /api/perf — Runtime performance metrics.
 *
- * Protected by CRON_SECRET header or query param.
+ * Protected by CRON_SECRET via `Authorization: Bearer <secret>` header only.
+ * Query-string authentication is not supported (secrets must not appear in URLs).
+ * Fails closed (401) when CRON_SECRET is not configured in the environment.
 * Returns Node.js memory usage, process uptime, and SSE connection count.
 */
 export function GET(request: Request) {
@@ -1,4 +1,5 @@
 import type { Metadata, Viewport } from "next";
+import { headers } from "next/headers";
 import { Manrope, Source_Sans_3 } from "next/font/google";
 import { TRPCProvider } from "~/lib/trpc/provider.js";
 import { ServiceWorkerRegistration } from "~/components/layout/ServiceWorkerRegistration.js";
@@ -45,11 +46,12 @@ export const viewport: Viewport = {
  themeColor: "#0284c7",
 };

-export default function RootLayout({ children }: { children: React.ReactNode }) {
+export default async function RootLayout({ children }: { children: React.ReactNode }) {
+  const nonce = (await headers()).get("x-nonce") ?? undefined;
  return (
    <html lang="en" suppressHydrationWarning>
      <head>
-        <script dangerouslySetInnerHTML={{__html: `
+        <script nonce={nonce} dangerouslySetInnerHTML={{__html: `
  try {
    var p = JSON.parse(localStorage.getItem('capakraken_theme') || '{}');
    if (p.mode === 'dark') document.documentElement.classList.add('dark');
@@ -0,0 +1,44 @@
+/**
+ * MfaSetup security contract tests
+ *
+ * These tests verify the static source of MfaSetup.tsx to ensure the TOTP
+ * secret and otpauth:// URI are never transmitted to an external QR-code
+ * rendering service.
+ *
+ * Static source analysis is intentionally used here rather than a full React
+ * render test because:
+ * - The vitest environment for apps/web is "node" (not jsdom).
+ * - The security property being asserted is structural (absence of external
+ *   URLs), not behavioural, making source-level assertion appropriate.
+ * - A render test would require a full React + browser environment and would
+ *   be fragile against irrelevant UI changes.
+ */
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { describe, expect, it } from "vitest";
+
+const SOURCE_PATH = resolve(__dirname, "./MfaSetup.tsx");
+const source = readFileSync(SOURCE_PATH, "utf-8");
+
+describe("MfaSetup — no external QR-code service", () => {
+  it("does not reference api.qrserver.com", () => {
+    expect(source).not.toMatch(/qrserver\.com/);
+  });
+
+  it("does not reference chart.googleapis.com", () => {
+    expect(source).not.toMatch(/chart\.googleapis\.com/);
+  });
+
+  it("does not reference any known external QR-generation service", () => {
+    // Guard against known external QR APIs and generic patterns
+    expect(source).not.toMatch(/https?:\/\/[^'"]*qr[^'"]*\.(com|io|dev)[^'"]*uri/i);
+  });
+
+  it("imports the local qrcode package for offline generation", () => {
+    expect(source).toMatch(/import\s+QRCode\s+from\s+['"]qrcode['"]/);
+  });
+
+  it("generates the QR code as a data URL (stays in-browser, no network request)", () => {
+    expect(source).toMatch(/QRCode\.toDataURL/);
+  });
+});
@@ -0,0 +1,77 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { NextRequest } from "next/server";
+
+// Web Crypto is available in the test environment (Node 20+)
+
+async function importMiddleware(nodeEnv: string) {
+  vi.stubEnv("NODE_ENV", nodeEnv);
+  vi.resetModules();
+  const mod = await import("./middleware.js");
+  return mod.middleware;
+}
+
+describe("middleware — Content-Security-Policy", () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+    vi.resetModules();
+  });
+
+  it("sets a Content-Security-Policy header on every response", async () => {
+    const middleware = await importMiddleware("production");
+    const req = new NextRequest("http://localhost:3100/");
+    const res = middleware(req);
+    expect(res.headers.get("Content-Security-Policy")).toBeTruthy();
+  });
+
+  it("production: script-src contains a nonce and does NOT contain unsafe-inline or unsafe-eval", async () => {
+    const middleware = await importMiddleware("production");
+    const req = new NextRequest("http://localhost:3100/dashboard");
+    const res = middleware(req);
+    const csp = res.headers.get("Content-Security-Policy") ?? "";
+    const scriptSrc = csp.split(";").find((d) => d.trim().startsWith("script-src")) ?? "";
+    expect(scriptSrc).toMatch(/'nonce-[A-Za-z0-9+/=]+'/);
+    expect(scriptSrc).not.toContain("'unsafe-inline'");
+    expect(scriptSrc).not.toContain("'unsafe-eval'");
+  });
+
+  it("production: each request gets a unique nonce", async () => {
+    const middleware = await importMiddleware("production");
+    const res1 = middleware(new NextRequest("http://localhost:3100/a"));
+    const res2 = middleware(new NextRequest("http://localhost:3100/b"));
+    const nonce1 = res1.headers.get("Content-Security-Policy")?.match(/'nonce-([^']+)'/)?.[1];
+    const nonce2 = res2.headers.get("Content-Security-Policy")?.match(/'nonce-([^']+)'/)?.[1];
+    expect(nonce1).toBeTruthy();
+    expect(nonce2).toBeTruthy();
+    expect(nonce1).not.toBe(nonce2);
+  });
+
+  it("production: x-nonce request header matches the nonce in the CSP response header", async () => {
+    const middleware = await importMiddleware("production");
+    const req = new NextRequest("http://localhost:3100/settings");
+    const res = middleware(req);
+    const cspNonce = res.headers.get("Content-Security-Policy")?.match(/'nonce-([^']+)'/)?.[1];
+    // The nonce is forwarded on the request (for server components) — not readable from
+    // the response directly, but verifiable via the CSP header consistency.
+    expect(cspNonce).toBeTruthy();
+    expect(cspNonce?.length).toBeGreaterThan(10);
+  });
+
+  it("development: script-src includes unsafe-eval and unsafe-inline for HMR", async () => {
+    const middleware = await importMiddleware("development");
+    const req = new NextRequest("http://localhost:3100/");
+    const res = middleware(req);
+    const csp = res.headers.get("Content-Security-Policy") ?? "";
+    const scriptSrc = csp.split(";").find((d) => d.trim().startsWith("script-src")) ?? "";
+    expect(scriptSrc).toContain("'unsafe-eval'");
+    expect(scriptSrc).toContain("'unsafe-inline'");
+  });
+
+  it("frame-ancestors is always 'none' regardless of environment", async () => {
+    for (const env of ["production", "development"] as const) {
+      const middleware = await importMiddleware(env);
+      const res = middleware(new NextRequest("http://localhost:3100/"));
+      const csp = res.headers.get("Content-Security-Policy") ?? "";
+      expect(csp).toContain("frame-ancestors 'none'");
+    }
+  });
+});
@@ -0,0 +1,48 @@
+import { NextRequest, NextResponse } from "next/server";
+
+function buildCsp(nonce: string, isProd: boolean): string {
+  const scriptSrc = isProd
+    ? `'self' 'nonce-${nonce}'`
+    : `'self' 'unsafe-eval' 'unsafe-inline'`;
+
+  const imgSrc = isProd ? "'self' data: blob:" : "'self' data: blob: https:";
+
+  return [
+    "default-src 'self'",
+    `script-src ${scriptSrc}`,
+    "style-src 'self' 'unsafe-inline'",
+    `img-src ${imgSrc}`,
+    "font-src 'self' data:",
+    "connect-src 'self' https://generativelanguage.googleapis.com https://*.openai.com https://*.azure.com",
+    "frame-ancestors 'none'",
+    "base-uri 'self'",
+    "form-action 'self'",
+  ].join("; ");
+}
+
+export function middleware(request: NextRequest): NextResponse {
+  // Generate a cryptographically random nonce for this request
+  const nonceBytes = new Uint8Array(16);
+  crypto.getRandomValues(nonceBytes);
+  const nonce = btoa(String.fromCharCode(...nonceBytes));
+
+  const isProd = process.env.NODE_ENV === "production";
+  const csp = buildCsp(nonce, isProd);
+
+  // Forward nonce to server components via request header
+  const requestHeaders = new Headers(request.headers);
+  requestHeaders.set("x-nonce", nonce);
+  requestHeaders.set("Content-Security-Policy", csp);
+
+  const response = NextResponse.next({ request: { headers: requestHeaders } });
+  response.headers.set("Content-Security-Policy", csp);
+
+  return response;
+}
+
+export const config = {
+  matcher: [
+    // Apply to all routes except Next.js internals and static assets
+    "/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp)$).*)",
+  ],
+};
@@ -56,7 +56,7 @@ services:
      # (localhost:5433) must not bleed into the container where "localhost" is
      # the container itself, not the host.
      DATABASE_URL: postgresql://capakraken:capakraken_dev@postgres:5432/capakraken
-      REDIS_URL: ${REDIS_URL:-redis://redis:6379}
+      REDIS_URL: redis://redis:6379
      NEXTAUTH_URL: ${NEXTAUTH_URL:-http://localhost:3100}
      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET:?set NEXTAUTH_SECRET}
      # Bypass auth + API rate limiters so E2E test runs don't exhaust
@@ -0,0 +1,200 @@
+# Developer Runbook
+
+**Stand:** 2026-04-01  
+**Zweck:** Vollständige Referenz für lokales Setup, täglichen Betrieb und Recovery-Szenarien.
+
+---
+
+## Erstmaliges Setup (Fresh Checkout)
+
+```bash
+# 1. Repo klonen
+git clone <url> capakraken && cd capakraken
+
+# 2. Root-Env anlegen (NEXTAUTH_SECRET ist Pflicht, kein Default)
+cp .env.example .env
+# .env öffnen und NEXTAUTH_SECRET setzen (min. 32 zufällige Zeichen)
+# Beispiel: openssl rand -hex 32
+
+# 3. Docker-Stack starten (Postgres + Redis + App)
+docker compose --profile full up -d
+
+# 4. Warten bis gesund, dann Seed ausführen
+docker compose exec app pnpm --filter @capakraken/db exec prisma db seed
+```
+
+Der App-Container führt beim Start automatisch `prisma migrate deploy` + `prisma generate` aus (via `tooling/docker/app-dev-start.sh`).
+
+---
+
+## Täglicher Start
+
+```bash
+docker compose --profile full up -d
+```
+
+Nur Postgres + Redis (ohne App — z. B. für `pnpm run dev` auf dem Host):
+
+```bash
+docker compose up -d postgres redis
+pnpm run dev
+```
+
+---
+
+## Env-Var-Strategie
+
+### Warum Docker-interne URLs hardcodiert sind
+
+`docker-compose.yml` setzt `DATABASE_URL` und `REDIS_URL` als **explizite Literal-Strings** — kein `${VAR:-default}`.
+
+Hintergrund: Docker Compose löst Shell-Substitutionen (`${VAR:-fallback}`) gegen das **Host-Environment** auf, bevor der Container startet. Hatte der Host ein `DATABASE_URL=postgresql://localhost:5433/...` gesetzt (z. B. für lokale Entwicklung ohne Docker), landete dieser Wert im Container — wo `localhost` der Container selbst ist, nicht der Host. Das brach die DB-Verbindung.
+
+Explizite Literal-Werte im `environment:`-Block haben höchste Priorität und können nicht durch Host-Env-Vars überschrieben werden.
+
+**Regel:** Docker-interne Service-DNS-Namen (`postgres`, `redis`) dürfen nie in `${...}`-Ausdrücken stehen.
+
+### E2E_TEST_MODE — warum doppelt gesetzt
+
+Das Flag muss an **zwei Stellen** stehen:
+
+| Ort | Wann aktiv |
+|---|---|
+| `docker-compose.yml` → `environment:` | Wenn die App im Docker-Container läuft |
+| `apps/web/.env.local` | Wenn die App lokal per `pnpm run dev` läuft |
+
+Next.js lädt `.env.local` via Volume-Mount. Docker Compose liest nur seinen eigenen `environment:`-Block. Beide Quellen sind nötig — es gibt keine gemeinsame "eine Stelle".
+
+### Geheime Werte (API-Keys, SMTP, etc.)
+
+Secrets werden **nicht** in `docker-compose.yml` gesetzt (versionierte Datei). Sie gehören in:
+
+- **Lokale Entwicklung:** root `.env` (gitignored)
+- **Docker-Container:** Env-Block in `docker-compose.yml` ist für nicht-geheime Werte. Geheime Werte kommen via `env_file: .env` in docker-compose (`.env` ist gitignored und wird nie committed).
+
+Benötigte Env-Vars für KI-Funktionen:
+
+```
+AZURE_OPENAI_API_KEY=<Azure OpenAI API Key>
+GEMINI_API_KEY=<Google Gemini API Key>
+```
+
+---
+
+## DB-Migration-Strategie
+
+### Normale Entwicklung: `migrate dev`
+
+```bash
+node scripts/prisma-with-env.mjs migrate dev --name <beschreibender_name>
+```
+
+- Erzeugt eine neue Migration unter `packages/db/prisma/migrations/`
+- Wendet sie auf die lokale DB an
+- Aktualisiert den Prisma Client
+- **Immer committen** — die Migration-Datei ist Teil des Repos
+
+### Production / Docker: `migrate deploy`
+
+```bash
+node scripts/prisma-with-env.mjs migrate deploy
+```
+
+- Wendet nur bereits erstellte Migrationen an (kein Schema-Diff)
+- Idempotent: Bereits angewandte Migrationen werden übersprungen
+
+### NIEMALS `db push` in einer Migration-verwalteten Umgebung
+
+`db push` schreibt Schema-Änderungen direkt in die DB **ohne** einen `_prisma_migrations`-Eintrag. Wird danach `migrate deploy` ausgeführt, scheitert es mit **P3005** ("database schema is not empty").
+
+### Recovery P3005 — Bestehende DB ohne Migrations-History
+
+Symptom: `prisma migrate deploy` meldet P3005.  
+Ursache: DB wurde initial per `db push` aufgesetzt.
+
+Lösung:
+
+```bash
+# Welche Migrationen existieren?
+ls packages/db/prisma/migrations/
+
+# Für jede Migration, die bereits in der DB ist, ausführen:
+node scripts/prisma-with-env.mjs migrate resolve --applied <migration_folder_name>
+# Beispiel:
+# node scripts/prisma-with-env.mjs migrate resolve --applied 20260401000000_active_sessions
+
+# Danach: migrate deploy läuft normal durch
+node scripts/prisma-with-env.mjs migrate deploy
+```
+
+`migrate resolve --applied` erstellt den `_prisma_migrations`-Eintrag ohne SQL auszuführen — es teilt Prisma mit, dass diese Migration bereits angewandt wurde.
+
+---
+
+## Container-Neustart nach Code-Änderungen
+
+| Änderung | Aktion |
+|---|---|
+| TypeScript-Quellcode | Kein Restart nötig (Hot Reload via Turborepo) |
+| `schema.prisma` geändert | `docker compose restart app` (führt `prisma generate` aus) |
+| Neue Migration erstellt | `docker compose restart app` (führt `migrate deploy` aus) |
+| `docker-compose.yml` geändert | `docker compose --profile full up -d` (recreate) |
+| Node-Module aktualisiert | `docker compose build app && docker compose --profile full up -d` |
+
+### Nach `--force-recreate` oder Image-Rebuild
+
+Der App-Container benötigt beim ersten Start nach einem Rebuild Zeit für `pnpm install`. Logs prüfen:
+
+```bash
+docker compose logs -f app
+```
+
+Warten bis: `✓ Ready on http://0.0.0.0:3100`
+
+---
+
+## Kompletter DB-Reset
+
+```bash
+# Stack stoppen
+docker compose --profile full down
+
+# Named Volume löschen (verliert alle Daten!)
+docker volume rm capakraken_pgdata
+
+# Neu starten — Container führt beim Start Migrationen aus
+docker compose --profile full up -d
+
+# Seed ausführen
+docker compose exec app pnpm --filter @capakraken/db exec prisma db seed
+```
+
+---
+
+## E2E-Tests gegen den Dev-Server
+
+```bash
+cd apps/web
+
+# Alle Dev-System-Tests
+pnpm exec playwright test --config=playwright.dev.config.ts
+
+# Nur RBAC-Tests
+pnpm exec playwright test e2e/dev-system/rbac-permissions.spec.ts --config=playwright.dev.config.ts
+pnpm exec playwright test e2e/dev-system/rbac-data-access.spec.ts --config=playwright.dev.config.ts
+```
+
+Voraussetzung: Dev-Server läuft auf `localhost:3100` (Docker oder `pnpm run dev`).  
+`E2E_TEST_MODE=true` muss in der laufenden Instanz gesetzt sein (s. o.).
+
+---
+
+## Häufige Probleme
+
+| Problem | Ursache | Fix |
+|---|---|---|
+| P3005 bei `migrate deploy` | DB per `db push` initialisiert | `migrate resolve --applied` für jede bestehende Migration |
+| P1001 "Can't reach database" | `DATABASE_URL` zeigt auf falschen Host | Im Container ist `localhost` der Container selbst; Docker-interne URL (`postgres:5432`) verwenden |
+| tRPC 401 nach E2E-Tests | E2E-Sessions haben echte Sessions aus `active_sessions` verdrängt | `E2E_TEST_MODE=true` setzen (registriert keine `active_sessions`) |
+| Auth-Rate-Limit erschöpft | Zu viele Logins in Tests | `globalSetup` nutzt StorageState; direkte `signIn()`-Calls in Tests minimieren |
+| Timeline leer nach Tests | E2E-Session hat Admin-Session aus `active_sessions` gekickt | Einloggen + E2E_TEST_MODE prüfen |
@@ -8,8 +8,8 @@
    "prebuild": "pnpm check:exports && pnpm check:imports",
    "build": "node ./scripts/run-from-workspace-root.mjs turbo build",
    "lint": "node ./scripts/run-from-workspace-root.mjs turbo lint",
-    "test": "node ./scripts/run-from-workspace-root.mjs turbo run test:unit",
-    "test:unit": "node ./scripts/run-from-workspace-root.mjs turbo test:unit",
+    "test": "node ./scripts/run-from-workspace-root.mjs turbo run test:unit --concurrency=2",
+    "test:unit": "node ./scripts/run-from-workspace-root.mjs turbo test:unit --concurrency=2",
    "test:e2e": "node ./scripts/run-from-workspace-root.mjs turbo test:e2e",
    "test:scripts": "node --test scripts/*.test.mjs",
    "check:architecture": "node ./scripts/check-architecture-guardrails.mjs",
@@ -0,0 +1,129 @@
+import { describe, expect, it, vi } from "vitest";
+import { assertWebhookUrlAllowed } from "../lib/ssrf-guard.js";
+
+// Mock dns.lookup so tests do not require real DNS resolution.
+vi.mock("node:dns/promises", () => ({
+  lookup: vi.fn(async (hostname: string) => {
+    const mapping: Record<string, string> = {
+      "example.com": "93.184.216.34",
+      "hooks.external.io": "52.1.2.3",
+    };
+    const ip = mapping[hostname];
+    if (!ip) throw new Error(`ENOTFOUND ${hostname}`);
+    return { address: ip, family: 4 };
+  }),
+}));
+
+describe("assertWebhookUrlAllowed — SSRF guard", () => {
+  // ── Allowed targets ─────────────────────────────────────────────────────────
+
+  it("allows a valid HTTPS URL that resolves to a public IP", async () => {
+    await expect(
+      assertWebhookUrlAllowed("https://example.com/webhook"),
+    ).resolves.toBeUndefined();
+  });
+
+  it("allows an HTTPS URL with a path and query string", async () => {
+    await expect(
+      assertWebhookUrlAllowed("https://hooks.external.io/events?source=capakraken"),
+    ).resolves.toBeUndefined();
+  });
+
+  // ── Rejected schemes ─────────────────────────────────────────────────────────
+
+  it("rejects an HTTP URL (only HTTPS allowed)", async () => {
+    await expect(
+      assertWebhookUrlAllowed("http://example.com/webhook"),
+    ).rejects.toMatchObject({ code: "BAD_REQUEST" });
+  });
+
+  it("rejects an FTP URL", async () => {
+    await expect(
+      assertWebhookUrlAllowed("ftp://example.com/file"),
+    ).rejects.toMatchObject({ code: "BAD_REQUEST" });
+  });
+
+  it("rejects a completely invalid URL", async () => {
+    await expect(
+      assertWebhookUrlAllowed("not-a-url"),
+    ).rejects.toMatchObject({ code: "BAD_REQUEST" });
+  });
+
+  // ── Blocked hostnames ────────────────────────────────────────────────────────
+
+  it("rejects localhost by hostname", async () => {
+    await expect(
+      assertWebhookUrlAllowed("https://localhost/callback"),
+    ).rejects.toMatchObject({ code: "BAD_REQUEST" });
+  });
+
+  it("rejects the AWS cloud metadata endpoint by hostname", async () => {
+    await expect(
+      assertWebhookUrlAllowed("https://169.254.169.254/latest/meta-data"),
+    ).rejects.toMatchObject({ code: "BAD_REQUEST" });
+  });
+
+  it("rejects Google cloud metadata by hostname", async () => {
+    await expect(
+      assertWebhookUrlAllowed("https://metadata.google.internal/computeMetadata/v1"),
+    ).rejects.toMatchObject({ code: "BAD_REQUEST" });
+  });
+
+  // ── Blocked IP ranges (direct IP addresses as hostname) ─────────────────────
+
+  it("rejects IPv4 loopback 127.0.0.1", async () => {
+    await expect(
+      assertWebhookUrlAllowed("https://127.0.0.1/callback"),
+    ).rejects.toMatchObject({ code: "BAD_REQUEST" });
+  });
+
+  it("rejects IPv4 loopback 127.1.2.3 (full /8 block)", async () => {
+    await expect(
+      assertWebhookUrlAllowed("https://127.1.2.3/callback"),
+    ).rejects.toMatchObject({ code: "BAD_REQUEST" });
+  });
+
+  it("rejects RFC 1918 private address 10.0.0.1", async () => {
+    await expect(
+      assertWebhookUrlAllowed("https://10.0.0.1/callback"),
+    ).rejects.toMatchObject({ code: "BAD_REQUEST" });
+  });
+
+  it("rejects RFC 1918 private address 172.16.0.1", async () => {
+    await expect(
+      assertWebhookUrlAllowed("https://172.16.0.1/callback"),
+    ).rejects.toMatchObject({ code: "BAD_REQUEST" });
+  });
+
+  it("rejects RFC 1918 private address 192.168.1.100", async () => {
+    await expect(
+      assertWebhookUrlAllowed("https://192.168.1.100/callback"),
+    ).rejects.toMatchObject({ code: "BAD_REQUEST" });
+  });
+
+  it("rejects link-local address 169.254.1.1", async () => {
+    await expect(
+      assertWebhookUrlAllowed("https://169.254.1.1/callback"),
+    ).rejects.toMatchObject({ code: "BAD_REQUEST" });
+  });
+
+  // ── DNS fail-closed behaviour ────────────────────────────────────────────────
+
+  it("rejects a hostname that cannot be resolved (fail-closed)", async () => {
+    // "unresolvable.internal" is not in the mock DNS table — lookup throws ENOTFOUND.
+    await expect(
+      assertWebhookUrlAllowed("https://unresolvable.internal/hook"),
+    ).rejects.toMatchObject({ code: "BAD_REQUEST" });
+  });
+
+  // ── DNS-rebinding protection ──────────────────────────────────────────────────
+
+  it("rejects a public hostname that resolves to a private IP (DNS rebinding)", async () => {
+    const { lookup } = await import("node:dns/promises");
+    vi.mocked(lookup).mockResolvedValueOnce({ address: "192.168.0.1", family: 4 });
+
+    await expect(
+      assertWebhookUrlAllowed("https://rebind.example.com/hook"),
+    ).rejects.toMatchObject({ code: "BAD_REQUEST" });
+  });
+});
@@ -14,6 +14,12 @@ vi.mock("../lib/audit.js", () => ({
  createAuditEntry: vi.fn(),
 }));

+// Mock the SSRF guard so tests do not perform real DNS lookups.
+// The guard's security behaviour is covered separately in ssrf-guard.test.ts.
+vi.mock("../lib/ssrf-guard.js", () => ({
+  assertWebhookUrlAllowed: vi.fn().mockResolvedValue(undefined),
+}));
+
 function createContext(db: Record<string, unknown>) {
  return {
    db: db as never,
@@ -1,7 +1,155 @@
-# CapaKraken — Umsetzungsplan: Security + Platform Issues
+# CapaKraken — Umsetzungsplan

 Gitea-Repo: `https://gitea.hartmut-noerenberg.com/Hartmut/plANARCHY`
-Stand: 2026-04-01 | Issues: #19, #20, #21, #22, #23, #24
+Stand: 2026-04-01 | Issues: #19–#26
+
+---
+
+## Plan: In-Review-Tickets verifizieren und in main integrieren
+
+### Anforderungsanalyse
+
+8 Tickets sind `in-review`. Ziel: jeden Ticket-Scope im Code verifizieren, Gitea-Kommentar
+mit Bewertung (✅ akzeptiert / ⚠️ Nachbesserung nötig) hinterlassen, dann alle offenen
+Changes in einem sauberen Commit auf `main` integrieren.
+
+**Umfang der Verifikation pro Ticket:**
+- Code-Artefakte im Repo prüfen (Dateien, Tests)
+- Quality-Gates (tsc, test:unit) müssen grün sein
+- Akzeptanzkriterien aus dem Ticket-Body abgleichen
+- Gitea-Kommentar: Strukturiertes Urteil mit Befunden
+
+**Integration-Strategie:**
+- Alle ungestagten Änderungen (`git status`) gehören zu den Tickets #20, #22, #25, #26
+- Ein einziger Commit auf `main` mit klarer Commit-Message
+- plan.md und docs/ mitcommiten
+
+### Betroffene Pakete & Dateien
+
+| Paket | Dateien | Art der Änderung |
+|-------|---------|-----------------|
+| `apps/web` | `next.config.ts`, `src/app/layout.tsx`, `src/middleware.ts`, `src/middleware.test.ts`, `src/app/api/perf/route.ts`, `src/app/api/perf/route.test.ts`, `src/components/security/MfaSetup.test.ts`, `e2e/dev-system/rbac-data-access.spec.ts`, `e2e/dev-system/helpers.ts` | Verifikation + commit |
+| `packages/api` | `src/__tests__/ssrf-guard.test.ts`, `src/__tests__/webhook-procedure-support.test.ts` | Verifikation + commit |
+| root | `package.json`, `docker-compose.yml`, `docs/developer-runbook.md`, `plan.md` | Verifikation + commit |
+
+### Task-Liste (atomare Schritte in Reihenfolge)
+
+**Phase 1 — Verifikation & Kommentierung (sequenziell, ein Ticket nach dem anderen)**
+
+- [ ] **V-1:** Ticket #19 (MFA-QR) — Code-Check: `MfaSetup.tsx` + `MfaSetup.test.ts`; Urteil auf Gitea posten
+- [ ] **V-2:** Ticket #20 (Webhook SSRF) — Code-Check: `ssrf-guard.ts` + `ssrf-guard.test.ts` + `webhook-procedure-support.test.ts`; Urteil posten
+- [ ] **V-3:** Ticket #21 (/api/perf) — Code-Check: `route.ts` + `route.test.ts`; Urteil posten
+- [ ] **V-4:** Ticket #22 (CSP) — Code-Check: `middleware.ts` + `middleware.test.ts` + `next.config.ts` + `layout.tsx`; Urteil posten
+- [ ] **V-5:** Ticket #23 (Active-Session-Registry) — Code-Check: Session-Guard-Middleware, Auth-Flow; Urteil posten
+- [ ] **V-6:** Ticket #24 (Docker reproducibility) — Code-Check: `docker-compose.yml`, Dockerfile.dev; Urteil posten
+- [ ] **V-7:** Ticket #25 (Env/Migration-Strategie) — Code-Check: `docker-compose.yml`, `docs/developer-runbook.md`; Urteil posten
+- [ ] **V-8:** Ticket #26 (RBAC E2E-Tests) — Code-Check: `rbac-data-access.spec.ts`; Urteil posten
+
+**Phase 2 — Quality Gates**
+
+- [ ] **Q-1:** `pnpm --filter @capakraken/web exec tsc --noEmit` — keine Fehler
+- [ ] **Q-2:** `pnpm --filter @capakraken/api test:unit` — alle Tests grün
+- [ ] **Q-3:** `pnpm --filter @capakraken/web test:unit` — alle Tests grün
+
+**Phase 3 — Git-Integration**
+
+- [ ] **G-1:** `git add` aller ungestagten Änderungen (alle Ticket-Artefakte)
+- [ ] **G-2:** Commit mit Message: `security/platform: close audit findings #19–#26 (tests, CSP nonce, SSRF guard, runbook)`
+- [ ] **G-3:** `git push origin main`
+
+### Abhängigkeiten
+
+- V-1 bis V-8 sind unabhängig voneinander, aber sequenziell (ein Kommentar pro Ticket)
+- Q-1 bis Q-3 können nach allen V-Tasks parallel laufen
+- G-1/G-2/G-3 müssen nach Q-1..3 erfolgen (kein Commit bei roten Tests)
+
+### Akzeptanzkriterien
+
+- [ ] Alle 8 in-review-Tickets haben einen Bewertungskommentar
+- [ ] `pnpm test:unit` läuft grün (beide Pakete)
+- [ ] `tsc --noEmit` ohne Fehler
+- [ ] Alle neuen Dateien in einem sauberen Commit auf `main`
+- [ ] `git status` danach: working tree clean
+
+### Risiken & offene Fragen
+
+- **Ticket #23 (Active-Session):** Die Implementierung in früheren Sessions könnte durch spätere Auth-Fixes (jti→sid) überholt worden sein — genau prüfen
+- **Ticket #24 vs. #25:** Überlappen in `docker-compose.yml` — beide Tickets betreffen dieselbe Datei; ein Commit deckt beide ab
+- **Push auf main:** Direkt auf `main` — kein PR da kein Remote-Review-Prozess konfiguriert. Sicherstellen dass alle Tests grün sind
+
+---
+
+---
+
+## Ticket #25 — Docker/Env/Migration-Strategie
+
+### Anforderungsanalyse
+
+Ziel: Docker-Container-Lifecycle ohne manuelle Eingriffe.
+
+Konkrete Mängel:
+1. `REDIS_URL` in `docker-compose.yml` nutzt `${REDIS_URL:-redis://redis:6379}` — Host-Env-Var kann Docker-internen Wert überschreiben (gleiche Klasse wie das behobene `DATABASE_URL`-Problem)
+2. Migration-Strategy undokumentiert: DB per `db push` aufgebaut, dann Migration hinzugefügt → `migrate deploy` scheitert mit P3005, erforderte `migrate resolve --applied`
+3. Kein Developer-Runbook (Setup, Restart, DB-Ops fehlen)
+
+### Betroffene Dateien
+
+| Datei | Änderung |
+|---|---|
+| `docker-compose.yml` | `REDIS_URL` hardcoden |
+| `docs/developer-runbook.md` | create |
+
+### Task-Liste
+
+- [ ] **#25-T1:** `docker-compose.yml` — `REDIS_URL: redis://redis:6379` (Literal, kein `${}`)
+- [ ] **#25-T2:** `docs/developer-runbook.md` erstellen mit: Erstmaligem Setup, DB-Migration-Strategie inkl. P3005-Recovery, E2E_TEST_MODE-Erklärung, Container-Neustart-Checkliste
+
+---
+
+## Ticket #26 — RBAC Datenzugriffs-Matrix E2E-Tests
+
+### Anforderungsanalyse
+
+Neue Testdatei `apps/web/e2e/dev-system/rbac-data-access.spec.ts` mit **Netzwerk-Ebene** tRPC-Response-Assertions (nicht nur UI-Sichtbarkeit).
+
+Grundlage `docs/route-access-matrix.md`:
+
+| tRPC-Prozedur | Audience | Admin | Manager | Viewer |
+|---|---|---|---|---|
+| `user.list` | `admin-only` | ✓ 200 | FORBIDDEN | FORBIDDEN |
+| `allocation.listView` | `planning-read` | ✓ 200 | ✓ 200 | FORBIDDEN |
+| `resource.listSummaries` | `resource-overview` | ✓ 200 | ✓ 200 | FORBIDDEN |
+| `user.listAssignable` | `manager-write` | ✓ 200 | ✓ 200 | FORBIDDEN |
+
+Technik: `page.evaluate()` mit `fetch()` gegen `/api/trpc/<proc>?batch=1&input=...` — läuft im Browser-Kontext der gespeicherten Session.
+
+tRPC GET-Format:
+```
+GET /api/trpc/<proc>?batch=1&input={"0":{"json":null}}
+Erfolg: [{"result":{"data":{"json":[...]}}}]
+Fehler: [{"error":{"json":{"data":{"code":"FORBIDDEN","httpStatus":403}}}}]
+```
+
+### Betroffene Dateien
+
+| Datei | Änderung |
+|---|---|
+| `apps/web/e2e/dev-system/rbac-data-access.spec.ts` | create |
+
+### Task-Liste
+
+- [ ] **#26-T1:** Datei erstellen mit `trpcQuery(page, procedure, input?)` Helper-Funktion
+- [ ] **#26-T2:** Admin-Describe-Block (4 Tests: alle 4 Prozeduren → Erfolg erwartet)
+- [ ] **#26-T3:** Manager-Describe-Block (4 Tests: `user.list` → FORBIDDEN, Rest → Erfolg)
+- [ ] **#26-T4:** Viewer-Describe-Block (4 Tests: alle → FORBIDDEN)
+- [ ] **#26-T5:** Smoke-Run: `pnpm exec playwright test e2e/dev-system/rbac-data-access.spec.ts --config=playwright.dev.config.ts`
+
+### Risiken
+
+- `allocation.listView` könnte ein Pflicht-Input-Objekt erfordern → Falls `BAD_REQUEST` statt FORBIDDEN, Schema im Router prüfen und minimalen Input übergeben
+- Viewer-Permissions aus DB-Seed (SystemRoleConfig) — prüfen ob VIEWER tatsächlich kein `VIEW_PLANNING` hat
+
+---

 ---