Root Cause (suspected)

Project list query does not apply ExternalUserPolicy filter predicate when the current user is external. System-level role grants broad read access that supersedes per-project membership enforcement.

Fix

In ProjectService.getProjects() (or equivalent list endpoint):

• Detect if current user is external
• If external, scope project list query to projects where the user has an explicit membership record
• Internal users continue to see all projects per existing policy

Related

• SZ-78 — External users must not hold ADMIN/PROJECT_MANAGER roles (enforcement not yet implemented — may be contributing factor)
• ExternalUserPolicy enforcement point audit recommended after fix

Breakdown:

Find the project list query — 15 min Add the external user filter predicate — 30 min Verify ExternalUserPolicy is being applied correctly elsewhere — 30 min Test fix locally — 30 min Rebuild image, redeploy, verify — 15 min

Found the Root cause and the fix:

The ProjectController is injected with externalUserPolicy, securityUtils, and userService but isn't using them for the list endpoint. Fix:

@GetMapping
@PreAuthorize("isAuthenticated()")
public ResponseEntity<Page<ProjectDto>> getAllProjects(
        final Pageable pageable,
        final Authentication authentication) {

    final User currentUser = securityUtils.getCurrentUser(authentication);

    final Page<ProjectDto> dtos;
    if (currentUser.isExternal()) {
        dtos = projectService.getAllProjectsForExternalUser(currentUser, pageable)
                .map(projectMapper::toDto);
    } else {
        dtos = projectService.getAllProjects(pageable)
                .map(projectMapper::toDto);
    }

    return ResponseEntity.ok(dtos);
}

Added 3 unit tests to cover this which would have exposed this problem.

Fix merged into wolsonsc