fix: close the upload and playground findings from the security audit, release v2.5.0

[joshunrau]

Closes three high-severity findings from the security audit, and cuts v2.5.0. The third landed after the release commit, so it ships in the next release rather than in v2.5.0.

POST /v1/instrument-records/upload returned every group's records (49fd5a9)

The upload service re-read its result by instrument id with the request's optional groupId as the only other filter. Prisma drops an undefined filter, so a body without groupId answered with every record for that instrument across every group, to any role holding create InstrumentRecord, including STANDARD, which cannot read records at all.

The response is now the rows keyed on the sessions the call itself created, which are the caller's own writes by construction. accessibleQuery is deliberately not AND-ed in: a STANDARD uploader holds no read InstrumentRecord rule, so CASL would throw rather than filter. The instrument lookup also forwards the caller's ability, as the single-record create path already does. The groupId field stays optional, since admins importing without a group is existing, tested behaviour.

A playground share link ran attacker JavaScript on the origin holding the API token (66c1425, 35e5ef1)

The playground evaluated every instrument, including one arriving in a share link, in its own window, the same origin whose IndexedDB persists the token the upload dialog obtains.

Previews now run in an iframe of a second Vite entry, preview.html, served from a different origin, and the editor and the frame talk only through postMessage payloads parsed against zod schemas. A hosted build names the preview origin with PLAYGROUND_PREVIEW_ORIGIN; a dev server uses the other loopback name, which is why the server now binds 127.0.0.1 so both answer. When no origin but the editor's own is available, the viewer refuses to render rather than fall back. Token persistence and share-link auto-load are unchanged by decision: the frame is the control.

The frame is a real second origin with allow-same-origin kept, not an opaque sandbox: interactive instruments render in a nested frame that reads parent.document, static assets need a service worker, and libui's theme hook reads localStorage, none of which an opaque origin permits. The follow-up commit collapses Tailwind's breakpoints in the frame's stylesheet so the preview keeps the desktop layout it had when the editor page's width satisfied them.

Deploy step outstanding for the hosted playground: point a second hostname at the same static build and build with PLAYGROUND_PREVIEW_ORIGIN set to it. Until then the hosted preview panel shows "Preview Unavailable" instead of running code on the editor's origin.

A User write grant let its holder make themselves an administrator (031e9e4, 6cc9ec3, 14d5bdc, d4be83f)

Creating, editing and deleting a user were gated on the matching User action. No base level grants one, but an admin can, and the holder could then set their own basePermissionLevel to ADMIN, add themselves to every group (updateById never checked groupIds), create an admin, or set an admin's password and log in as them. Scoping the grant to a group did not help: the scope is checked against the stored row, before the write.

• POST, PATCH and DELETE /v1/users are now ADMIN_ONLY, a new name for { action: 'manage', subject: 'all' } that the seven existing admin-only routes now use too. A non-admin previously granted a User write loses it.
• An admin can no longer delete, disable or demote their own account, so the last one cannot lock every admin-only route.
• User writes are no longer grantable: PUT /v1/users/:id/permissions refuses them and the permissions editor stops offering them. Grants stored before this still load; the editor marks them "No effect" and drops them on its next save.
• Choosing Manage (All) on All in the editor now warns that the grant makes the user an administrator.
• The security reference no longer claims group managers can modify users.

Also on the branch

• chore: release v2.5.0, whose changelog lists the first two fixes above.
• The odc-open-pr and odc-commit skill docs.

Verification

• Unit: apps/api/src/instrument-records/__tests__/instrument-records.service.spec.ts (result query keyed on created sessions; ability forwarded) and the new playground vitest project, apps/playground/src/preview/__tests__/protocol.test.ts (message schemas, error round trip, origin resolution). Both fail against the old code.
• E2E: testing/src/specs/authorization.spec.ts seeds a record in a foreign group and asserts a STANDARD upload without groupId returns only its own row; red against the old service with the foreign row present. New testing/src/specs/playground.spec.ts starts the playground alongside the other servers and checks the origin split, that share-link code runs but cannot reach the editor page (red when the frame is pointed at the editor's origin), that an interactive instrument renders, and that submissions come back.
• pnpm lint 34/34, pnpm test 152 files / 1337 tests, pnpm test:e2e 194/194, all from the repo root. Lint was re-run after the release commit; the full e2e run predates it.
• User-escalation fix: unit tests in apps/api/src/users/__tests__/users.controller.spec.ts (every write route refuses a group manager granted manage User), users.service.spec.ts (the self-guard), the schemas and the editor; apps/api/test/suites/02-user-permissions.suite.ts writes a manage User grant directly and checks that all five escalation requests get 403. E2E in authorization.spec.ts (the grant is refused; an admin cannot delete or disable themselves) and admin-management.spec.ts (only Read is offered on User; the warning appears). Each went red against the code it guards. pnpm lint 34/34, pnpm test 152 files / 1371 tests, pnpm test:e2e 197/198: the failure was a gateway ECONNRESET in gateway-assignment.spec.ts, which passed 10/10 when re-run alone. The warning's final wording was checked by web lint and the editor's unit tests only.

Not verified: the hosted playground with a real second hostname (dev only exercises the loopback pair), and the static-assets interactive example inside the frame (the e2e covers the React one).

Co-Authored-By: Claude Fable 5.1
Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com
Co-Authored-By: Claude Opus 5.5 (1M context)