Hardened DocVault access controls, agent auth, and CSV exports
A full repository review found missing admin and folder authorization checks, fail-open agent PSK behavior, fragile CSV export generation, and incomplete audit coverage. Commits e0d498d, 6df4c71, and 9f81995 close those gaps and add regression tests.
Commits e0d498d, 6df4c71, and 9f81995 harden several production-facing paths found during a full repository review.
Observed issues. internal/web/router.go registered /admin/... web routes inside login middleware but without auth.RequireRole(user.RoleAdmin). internal/vault/handler.go had no folder.Repository, so file upload/list/download/delete/checkout/checkin handlers could not enforce folder read, write, or admin permissions. internal/endpoint/handler.go only checked the PSK inside if h.psk != "", which meant an empty DOCVAULT_OSQUERY_PSK made agent endpoints fail open. CSV exports in internal/audit/handler.go and internal/web/pages.go were generated with manual string concatenation. Audit logging covered the protected JSON API group, but protected HTML form POST routes and authentication boundary events were not all logged.
Fix. Admin web routes now run through auth.RequireRole(user.RoleAdmin). Vault API handlers receive the folder repository and enforce folder permissions before file operations. Folder access checks now include creator admin ownership and inherited parent permissions. Web forms and pages enforce the same folder/admin boundaries before rendering or mutating data. DOCVAULT_OSQUERY_PSK is required at config load, and agent endpoints return service unavailable if authentication is not configured. JWT validation now separates access, refresh, and pending-2FA token types. Auth, refresh, pending-2FA, and CSRF cookies are marked Secure. CSV exports now use encoding/csv and prefix spreadsheet formula-like values. Protected web form POST routes now run through the audit middleware, the audit response wrapper preserves http.Flusher for SSE, and API/web login plus logout paths explicitly write authentication audit events.
Tests and verification. Added regression tests for CSV escaping, fail-closed agent PSK behavior, JWT token type validation, Secure cookies, Windows/UNC path parsing, web-form audit action derivation, and http.Flusher preservation. After the changes:
go test ./... # passed
go vet ./... # passed
go build ./... # passedLimit. Login attempts for usernames that do not exist are still not written to audit_logs because the schema requires a concrete user_id. Existing-user login failures, disabled-account login attempts, 2FA failures, successful logins, logout, protected JSON API actions, and protected web form POST actions are now covered.