From 64dccc4194db997c2903d4bd262464b017378a1f Mon Sep 17 00:00:00 2001 From: Matheus Pastorini Date: Mon, 17 Aug 2026 17:09:05 -0300 Subject: [PATCH] docs(rbac): correct assigned_inboxes comment for secure-by-default agent (CRM-181) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The comment claimed the upgrade migration GAVE read_all to every pre-existing role, so revoking it was always the admin's explicit act. With CRM-181 the evo-auth data-migration REVOKES read_all from the system `agent` role automatically (secure-by-default). Reword: the agent no longer holds read_all and sees only its member inboxes; account_owner/super_admin keep it; for custom roles, revoking remains the admin's explicit act. Behaviour unchanged — the enforcement here (read_all/administrator? only) already matches. Co-Authored-By: Claude Opus 4.8 --- app/models/user.rb | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/app/models/user.rb b/app/models/user.rb index 4da6f0f82..f78e69f68 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -149,8 +149,12 @@ def assigned_inboxes # treated as false here. # # There is deliberately NO zero-membership fallback: "see everything" comes - # ONLY from the conversations.read_all grant (which the upgrade migration - # gave every pre-existing role, so revoking it is the admin's explicit act). + # ONLY from the conversations.read_all grant. The default `agent` role is + # SECURE-BY-DEFAULT — it does NOT hold read_all (CRM-181), so an agent sees + # only its member inboxes and an agent with no membership sees nothing until + # assigned; account_owner/super_admin keep read_all. The evo-auth CRM-181 + # data-migration revokes read_all from the system `agent` role on upgrade; + # for CUSTOM roles an admin created, revoking is the admin's explicit act. # The old `inbox_members.empty? -> Inbox.all` degrade made that revoke # unenforceable for users with no memberships — the common state, since # most installs never assigned inboxes.