[bojanakovacic1401]

Component and requirement IDs

• Component: Resource authorization and course-scoped administration.
• Requirements: ACC-04 (J) and ADM-08 (N).
• Author(s): [@bojanakovacic1401](https://github.com/bojanakovacic1401)

Changes

• Implement ACC-04 attempt reads and owner-only draft updates with server-side authorization, input validation and atomic version checks.
• Implement ADM-08 course-scoped administration, limited administrative delegation, settings updates and revocation.
• Separate administrative capabilities from teaching permissions and access to student answers.
• Verify revocation using independent administrator/delegate clients and the exact delegate cookie issued before revocation, without another sign-in.
• Provide a repeatable in-memory simulator, metadata-only audit, React demonstration, domain model, access matrix, threat model and architecture/DFD diagrams.
• Integrate concrete policies with the shared Platform.Access component.
• Merge current main (8420f3b) into this branch through merge commit 3d75127 and resolve all six conflicts.
• Preserve main’s Identity, Audit and Authoring contributions, existing CI checks and account-registration UI.
• Keep the shared ACC-05/ACC-08 implementation unchanged. This contribution covers ACC-04 and ADM-08 and does not restore legacy files from PRs ACC-04 / ACC-08: KT1 implementacija, bezbednosni model i negativni testovi #20/ACC-04 / ACC-08: KT1 implementacija, bezbednosni model i negativni testovi #21.
• Add three regression tests for coexistence with main’s Identity functionality.

Verification

Actual local verification of the integrated source:

• 63/63 tests for ACC-04/ADM-08 passed, failed 0, skipped 0.
• 231/231 tests across the complete solution passed, including other teams’ test projects.
• 41/41 live HTTP demonstration scenarios passed.
• Frontend TypeScript/Vite build passed.

New GitHub Actions verification for commit 3d75127:

• backend: SUCCESS
• frontend: SUCCESS
• Live KT1 demonstration: SUCCESS
• Both the backend test-results artifact and acc04-adm08-kt1-results were uploaded.

Actions run: https://github.com/owlCoder/security-lab/actions/runs/41637786694

Architecture and data flow

Documentation is in docs/components/coursework/.

The diagrams cover both assigned components, the unified domain model and trust boundaries. The API resolves identity and current resource attributes server-side, calls the shared decision engine, and binds reads/writes to the authorized snapshot or current administrative grant.

The DFDs include provider/store responses, explicit rejection paths and application audit flows.

Main’s Identity functionality and the explicitly enabled Development-only KT1 simulator coexist. Production identity-provider integration remains planned.

Security checks and negative tests

Tests cover:

• Foreign-resource ID substitution, forged identity headers, blocked accounts and cross-course access.
• Identical public responses for foreign/missing resources, including dependency outages.
• Draft validation, stale/concurrent writes and protection of submitted/completed answers.
• Administrative capability restrictions, prohibited self-delegation/redelegation and cross-course revocation.
• Read/write denial using the same cookie issued before revocation.
• Metadata-only audit and absence of synthetic demo routes outside explicitly enabled Development mode.
• Preservation of main’s account-status endpoint and authorization.
• Rejection of attempts to use a KT1 administrative cookie for Identity administration.
• Rejection of attempts to use the Identity Development header to authenticate or elevate a KT1 caller.

Dependencies

KT1 uses synthetic Development-only sessions and deterministic provider test doubles. Real identity, membership, ATT/course adapters, persistent storage and durable audit integration remain KT2 work.

Actual Tapiz links, individual contribution references and at least one neighboring-team contract-review acknowledgement still need to be recorded. Successful tests and CI do not replace these external obligations.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T18:37:34.382930Z	3f53535	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[owlCoder]

Pregled: ACC-04 i ADM-08 jesu celine tima 8; GitHub Actions testovi i live demonstracija su prošli. Nakon merge-a #33 nastali su konflikti sa main. Molimo rebase/merge aktuelnog main, rešavanje konflikata i novi CI. Posebno proveriti da ovaj PR ne preuzima ACC-08 (celina tima 3) niti vraća duplirane ranije merge-ovane izmene #20/#21.

[owlCoder]

Ponovni pregled (03.11): ACC-04/ADM-08 pripadaju timu 8, ali grana i dalje ima merge konflikte sa aktuelnim main. Molimo uskladiti sa sadašnjim main i ponoviti CI. Proveriti da izmene ne vraćaju ACC-08 (dodeljen timu 3) niti dupliraju ranije spojeni sadržaj. Do rešavanja PR ostaje otvoren bez merge-a.

[bojanakovacic1401]

Poslata ispravka na ponovni pregled...

[owlCoder]

Ponovni pregled 03.11. uveče: ACC-04 i ADM-08 pripadaju timu 8 i poslednji CI/testovi i KT1 demonstracija su zeleni. Nakon novih merge-ova main grana ponovo ima konflikte; uskladite sa aktuelnim main i ponovite CI. Obavezno sačuvati integracije ostalih timova i ne dodavati ACC-08 (celina tima 3). PR ostaje otvoren do tehnički čistog merge-a.