authorization-xray

What this is for

"Who can do what?" - in grown systems nobody can answer this. Authorization checks are scattered: middleware here, decorator there, inline if (user.role...) somewhere else - and that one unprotected mutation endpoint is found during a pentest (or after). Distilling a complete permission matrix from code means finding every route, mapping every protection layer, spotting gaps and inconsistencies - drudge work plus semantics, i.e. LLM terrain.

Audience: Senior

• Security reviews get a complete permission matrix.
• Compliance audits get evidence of authorization coverage.
• New endpoint authors see how existing routes are protected.

Trigger: /authz

PROTECTION RULE - never ~/.claude/

Read-only skill. Guard required if write mode added later.

What You Must Do When Invoked

During analysis, assign a confidence level to each finding: proven (confirmed by evidence), likely (strong signal, needs review), or suspected (weak signal).

Step 1 - -help/-h check

Print usage block and stop.

Step 2 - Determine project path

Ask for -ProjectDir. Confirm. Note: report contains security-relevant findings - keep local.

Step 3 - Run collector

& .\scripts\authz-scan.ps1 -ProjectDir "<path>"

Step 4 - LLM analysis

1. Resolve protection chain per endpoint: global mounts (does mount path match endpoint path?) + route guards + decorators + inline checks in handler. Result per endpoint: effective checks with evidence.
2. Build matrix: endpoint x (authn: yes/no/unclear) x (authz: which role/check) x evidence.
3. Findings classes:
   • Unprotected + mutating (severity high; explicitlyPublic separate - intentionally public is not a finding, but list for confirmation).
   • Authn only, no authz on sensitive paths (/admin, /users/:id patterns: accessing foreign ID without ownership check - IDOR suspicion, mark as probable).
   • Inconsistency: similar resource paths with different protection strictness.
   • Dead roles: roles referenced in checks never assigned/defined anywhere.
4. Report: summary → high findings with evidence → matrix table → inconsistencies → IDOR suspicions → explicitly public (for confirmation) → open questions.

Step 5 - Produce report

Write authz-report.md:

# Authorization Report - <project>

## Summary
- <N> endpoints, <P> protected, <U> unprotected + mutating
- <I> IDOR suspicions, <D> dead roles

## High Severity
### 1. Unprotected Mutation Endpoints
Endpoint | File:Line | Without /api Mount | Why Missing
... | ... | ... | ...

## Permission Matrix
Endpoint | Authn | Authz / Role | Evidence
... | ... | ... | ...

## Inconsistencies
...

## IDOR Suspicions
...

## Open Questions

Usage

# Interactive
/authz

# Direct path
/authz C:\Projects\my-app

# Help
/authz --help