hiveiq-src/hiveops-guide
4
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

[Documentation] Guide KB still references decommissioned QDS_ADMIN role (follow-up to incident#253) #10

New Issue
Closed
opened 2026-07-08 15:34:33 -04:00 by hiveiq · 0 comments
hiveiq commented 2026-07-08 15:34:33 -04:00
Owner
Copy Link
Copy Source

Guide KB still documents QDS_ADMIN after the code purge (stale docs)

Follow-up to hiveops-incident#253 (Remove decommissioned QDS_ADMIN role from 5 backends), which is done and merged — QDS_ADMIN is now gone from the SecurityConfig/InstitutionContext of hiveops-incident, hiveops-recon, hiveops-devices, hiveops-guide, hiveops-transactions on develop, and it was already removed from the hiveops-auth Role enum (972a28a) so no JWT can carry it.

#253 deliberately scoped out the Guide's knowledge-base content. As a result the Guide now describes role-gates that no longer exist in code — e.g. several modules quote hasAnyRole('USER','CUSTOMER','ADMIN','MSP_ADMIN','QDS_ADMIN','BCOS_ADMIN') verbatim, but the real SecurityConfig no longer lists QDS_ADMIN. Doc-accuracy defect, not a runtime issue.

Scope — strip QDS_ADMIN from Guide content (26 refs / 23 files)

Remove QDS_ADMIN from role/allow-list mentions; keep the surviving roles (USER, CUSTOMER, ADMIN, MSP_ADMIN, BCOS_ADMIN, plus AGENT/SYSTEM where relevant) exactly as-is.

  • analytics/incidents: claude.md, internal.md
  • dashboard/cash-stats: claude.md, internal.md
  • devices/config-audit: claude.md, internal.md
  • incident/incident-tracker: claude.md, internal.md
  • incident/journal-events: architect.md, claude.md, internal.md
  • msp/institution-keys: claude.md, internal.md
  • platform/auth: overview.md ("Admin roles are MSP_ADMIN, BCOS_ADMIN (and QDS_ADMIN)")
  • recon/cash-reconciliation: claude.md, internal.md
  • recon/device-cycle-mgmt: claude.md, internal.md
  • technical/transactions: overview.md (x2)
  • transactions/customer-journey: claude.md, internal.md
  • transactions/journal-parsing: architect.md
  • transactions/reparse: internal.md

Also (separate repo, minor)

hiveops-src/SECURITY_AUDIT_2026-05-08.md — the QDS_ADMIN row was reworded to "legacy, pending purge"; now that the purge is complete it could read "removed (decommissioned)". Dated audit doc, low priority.

Notes

  • Zero runtime change — the role is unissuable.
  • Verify hiveops-guide/scripts/coverage-reconcile.py still passes after edits.
  • Branch off develop, PR -> develop.
## Guide KB still documents `QDS_ADMIN` after the code purge (stale docs) Follow-up to **hiveops-incident#253** (*Remove decommissioned QDS_ADMIN role from 5 backends*), which is **done and merged** — `QDS_ADMIN` is now gone from the `SecurityConfig`/`InstitutionContext` of hiveops-incident, hiveops-recon, hiveops-devices, hiveops-guide, hiveops-transactions on `develop`, and it was already removed from the hiveops-auth `Role` enum (`972a28a`) so **no JWT can carry it**. #253 deliberately scoped **out** the Guide's knowledge-base content. As a result the Guide now describes role-gates that no longer exist in code — e.g. several modules quote `hasAnyRole('USER','CUSTOMER','ADMIN','MSP_ADMIN','QDS_ADMIN','BCOS_ADMIN')` verbatim, but the real `SecurityConfig` no longer lists `QDS_ADMIN`. Doc-accuracy defect, not a runtime issue. ### Scope — strip `QDS_ADMIN` from Guide content (26 refs / 23 files) Remove `QDS_ADMIN` from role/allow-list mentions; keep the surviving roles (`USER, CUSTOMER, ADMIN, MSP_ADMIN, BCOS_ADMIN`, plus `AGENT`/`SYSTEM` where relevant) exactly as-is. - analytics/incidents: claude.md, internal.md - dashboard/cash-stats: claude.md, internal.md - devices/config-audit: claude.md, internal.md - incident/incident-tracker: claude.md, internal.md - incident/journal-events: architect.md, claude.md, internal.md - msp/institution-keys: claude.md, internal.md - platform/auth: overview.md ("Admin roles are MSP_ADMIN, BCOS_ADMIN (and QDS_ADMIN)") - recon/cash-reconciliation: claude.md, internal.md - recon/device-cycle-mgmt: claude.md, internal.md - technical/transactions: overview.md (x2) - transactions/customer-journey: claude.md, internal.md - transactions/journal-parsing: architect.md - transactions/reparse: internal.md ### Also (separate repo, minor) `hiveops-src/SECURITY_AUDIT_2026-05-08.md` — the `QDS_ADMIN` row was reworded to "legacy, *pending* purge"; now that the purge is complete it could read "removed (decommissioned)". Dated audit doc, low priority. ### Notes - Zero runtime change — the role is unissuable. - Verify `hiveops-guide/scripts/coverage-reconcile.py` still passes after edits. - Branch off `develop`, PR -> `develop`.
hiveiq self-assigned this 2026-07-08 15:34:33 -04:00
hiveiq added the Documentation label 2026-07-08 15:36:51 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Bug
Backend
Service, API, or data-layer work
 Breaking
Breaking change that won't be backward compatible
 Bug
Something is not working
 Dev Verified
Fix verified on bcos.dev by QA — cleared for production release
 Documentation
Documentation changes
 Enhancement
Improve existing functionality
 Feature
New functionality
 Frontend
UI / Svelte SPA work
 Pattern
For changes to our agent Pattern for detecting hardware faults
Priority
Critical
The priority is critical
Priority
High
The priority is high
Priority
Low
The priority is low
Priority
Medium
The priority is medium
Reopen
Fix was verified but the issue persists or regressed. Reopen and reassign for investigation.
Reviewed
Confirmed
Issue has been confirmed
Reviewed
Duplicate
This issue or pull request already exists
Reviewed
Invalid
Invalid issue
Reviewed
Won't Fix
This issue won't be fixed
Security
This is security issue
Status
Abandoned
Somebody has started to work on this but abandoned work
Status
Blocked
Something is blocking this issue or pull request
Status
Need More Info
Feedback is required to reproduce issue or to continue work
TEST
Tested
Not Fixed
Testing
Issue or pull request related to testing
 Verify Fix
Fix has been deployed to production. Verify the issue is resolved before closing.
 Verify/Production
Fix deployed to production — verify before closing
No Label Documentation
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
hiveiq hiveiq-browser johannes tristan (Tristan Smith)
No Assignees hiveiq
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: hiveiq-src/hiveops-guide#10
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?