← Security practices

Security debug tooling

When CakePHP debug is enabled, tenant-facing pages render a Show Security Info control in the footer. It displays the current member’s resolved policy methods/branch scopes and the authorization checks recorded during the request. The feature is diagnostic only and is omitted when debug is disabled.

What it shows

• whether the current identity is considered a superuser;
• policy class and method names;
• global, branch-only, or branch-and-children scope;
• the resolved branch IDs for each policy method; and
• each call made through KMP’s custom AuthorizationService::checkCan(), with action, resource description, allow/deny result, and optional-argument count.

The log is process-static for the current PHP execution context and contains only checks routed through checkCan(). It is not a durable audit trail and does not prove that every collection query applied a policy scope.

Use it

1. Start the local tenant application with DEBUG=true.
2. Sign in on the tenant host and open the page under investigation.
3. Select Show Security Info in the footer.
4. Compare the policy scope with the resource branch and look for the expected denied/allowed check.
5. Reproduce as a non-superuser; a superuser bypass can hide a missing policy assignment or branch condition.

The Stimulus controller only toggles the already-rendered panel and scrolls it into view. It does not fetch additional server data. Page navigation creates a new request and therefore a new rendered snapshot.

Interpret results carefully

• No authenticated user: the helper reports that no current user exists.
• No policies: an ordinary user should normally be denied; a superuser may still be allowed through the superuser bypass.
• No authorization checks: the page may not have called checkCan(), may have used controller middleware/policy APIs that are not in this diagnostic log, or may genuinely be public.
• Allowed but empty collection: inspect applyScope() and branch/query conditions separately.
• Correct policy, wrong tenant data: this is a tenant binding/cache/table locator problem, not a policy-display problem.

Use PHPUnit policy/controller tests and multi-tenant tests as the actual proof. Do not change production behavior solely to make this panel look different.

Security limitations

Debug output reveals permission names, class/method names, and internal branch IDs. DEBUG must be false in production and other customer-accessible environments. Never paste the complete panel into a public issue when it may reveal tenant structure or user privileges.

The platform-admin portal has a different central identity/authorization model. This tenant footer helper is not a platform operations audit view.

Implementation map

• app/src/Services/AuthorizationService.php records debug checks.
• app/src/View/Helper/SecurityDebugHelper.php renders the tables.
• app/templates/element/copyrightFooter.php adds the debug-only control/panel.
• app/assets/js/controllers/security-debug-controller.js toggles visibility.
• app/tests/TestCase/Services/SecurityDebugTest.php and app/tests/js/controllers/security-debug-controller.test.js cover the two layers.

After changing it, run the focused PHP/Jest tests and confirm keyboard/focus behavior and semantics in a browser. The toggle is user-facing UI and must meet the same WCAG 2.2 Level AA expectations as the rest of KMP.