Odc API

apps/api serves clinical data segregated by group. Access is decided in two independent places: a guard that sees the request and no data, and a scope in the Prisma where that sees the rows. The only half a tool checks is the guard's presence (REQUIRE_ROUTE_ACCESS in the root eslint.config.js); the guard's value, and the scope entirely, are silent — no compiler, no test — so satisfying one and forgetting the other is green everywhere.

The scope is the half nothing checks

accessibleQuery(undefined, …) returns {}. apps/api/src/auth/ability.utils.ts opens the function with if (!ability) { return {}; } — an empty where, which reads every group's rows. The ability is optional by type (EntityOperationOptions in apps/api/src/core/types.ts is { ability?: AppAbility }), so tsc is satisfied, and a service spec running against a mocked model asserts back whatever arguments you passed it. This is the highest-severity mistake available in this repo, and the only thing standing in front of it is you reading the where (.agents/docs/architecture/auth-and-permissions.md, Layer 2).

Forwarding is the other half, and it has two shapes. Either the service method takes { ability }: EntityOperationOptions and its controller forwards @CurrentUser('ability'), or it takes currentUser?: RequestUser and reads .ability off it itself while its controller forwards @CurrentUser() — the second shape is apps/api/src/instruments/instruments.service.ts and apps/api/src/instrument-records/files/files.service.ts. In instruments.service.ts only findBundleById takes it as optional, because the gateway resolves an assignment's bundle unscoped, so a call site there that omits it compiles and queries every group.

Unscoped is a decision, not an omission. AuditService.find takes no ability at all, because a manage-all guard is the whole check on GET /v1/audit/logs; the inventory of routes that are deliberately unscoped is in .agents/docs/architecture/auth-and-permissions.md.

• Done when every Prisma query in your diff is accounted for — each one either names accessibleQuery in its where, or is unscoped for a reason your reply states. Every query, not a sample of them.
• Done when every handler whose service method receives an ability forwards it — @CurrentUser('ability') for the EntityOperationOptions shape, @CurrentUser() for the RequestUser shape — established by opening each handler, because nothing else establishes it.

The guard: @RouteAccess

Every controller handler carries one; REQUIRE_ROUTE_ACCESS in the root eslint.config.js flags a missing decorator, which is a 500 at request time rather than an open route. That rule sees nothing else — a wrong value is silent, and two of them are traps:

{ action, subject } runs ability.can against the subject type, never against rows; an array of them is .every(...).

Done when every handler your diff adds or changes names a @RouteAccess value and your reply says which — 'public' and [] in writing, because neither is distinguishable from a considered choice once written.