---
name: audit-rbac
description: Audit & fix RBAC and audit log compliance in API endpoints and frontend components
---

Audit the specified files or directories for RBAC and audit log compliance. **Fix every issue found immediately.**

## Rules

### API Endpoints (NestJS — `apps/api/src/`)
1. **Every mutation endpoint** (POST, PATCH, PUT, DELETE) MUST have `@RequirePermission('resource', 'action')`. If missing, **add it**.
2. **Read endpoints** (GET) should have `@RequirePermission('resource', 'read')`. If missing, **add it**.
3. **Self-endpoints** (e.g., `/me/preferences`) may skip `@RequirePermission` — authentication via `HybridAuthGuard` is sufficient.
4. **Controller format**: Must use `@Controller({ path: 'name', version: '1' })`, NOT `@Controller('v1/name')`. If wrong, **fix it**.
5. **Guards**: Use `@UseGuards(HybridAuthGuard, PermissionGuard)` at controller or endpoint level. Never skip PermissionGuard.
6. **Webhooks**: External webhook endpoints use `@Public()` — no auth required.

### Frontend Components (`apps/app/src/`)
1. **Every mutation element** (button, form submit, toggle, switch, file upload) MUST be gated with `usePermissions` from `@/hooks/use-permissions`. If not:
   - **Create/Add buttons**: Wrap with `{hasPermission('resource', 'create') && <Button>...`
   - **Edit/Delete in dropdown menus**: Wrap the menu item
   - **Inline form fields on detail pages**: Add `disabled={!canUpdate}`
   - **Status/property selectors**: Add `disabled={!canUpdate}`
2. **Actions columns** in tables: hide entire column when user lacks write permission.
3. **No manual role string parsing** (`role.includes('admin')`) — use `hasPermission()`.
4. **Nav items**: gate with `canAccessRoute(permissions, 'routeSegment')`.
5. **Page-level**: call `requireRoutePermission('segment', orgId)` server-side.

### Permission Resources
`organization`, `member`, `control`, `evidence`, `policy`, `risk`, `vendor`, `task`, `framework`, `audit`, `finding`, `questionnaire`, `integration`, `apiKey`, `trust`, `pentest`, `app`, `compliance`

### Multi-Product RBAC
- Products (compliance, pen testing) are org-level feature flags — NOT RBAC
- `app:read` gates compliance dashboard; `pentest:read` gates security product
- Custom roles can grant access to any combination of resources
- Portal-only resources (`policy`, `compliance`) do NOT grant app access

## Process
1. Read files specified in `$ARGUMENTS` (or scan the directory)
2. Check each rule above
3. **Fix every violation immediately** — don't just report
4. Run typecheck to verify: `bunx turbo run typecheck --filter=@trycompai/api --filter=@trycompai/app`