feat(sec): expand RBAC enforcement and telemetry

[Mr-Dark-debug]

Summary

• add SEC-001 migration introducing spaces schema, helper functions, and deny-by-default policies while mapping legacy role slugs
• extend admin guard adoption with audited user management and publish API instrumentation emitting metrics, traces, and structured logs
• document RBAC and observability updates, log new assumptions, and record weekly progress for the Phase-1 slice

Testing

• npm run test:unit -- --run tests/unit/require-admin.test.ts

---

https://chatgpt.com/codex/tasks/task_e_68ec7f0baa4c832db76aaf9288be2623

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
syntax-blogs	Error			Oct 26, 2025 5:59pm

[chatgpt-codex-connector]

💡 Codex Review

Syntax-blogs/tests/unit/observability-metrics.test.ts

Lines 30 to 37 in 98b6377

	it('records authz deny metrics with context tag', () => {
	recordAuthzDeny('admin_users', { reason: 'role_check' })
	expect(consoleSpy).toHaveBeenCalled()
	const payload = consoleSpy.mock.calls.at(-1)?.[1] as string
	expect(payload).toContain('"metric":"authz_denied_count"')
	expect(payload).toContain('"context":"admin_users"')
	expect(payload).toContain('"reason":"role_check"')

Align authz deny metric test with renamed tag

The recordAuthzDeny helper now emits a tag named resource (src/lib/observability/metrics.ts), but the unit test still asserts that the serialized payload contains a context field. This mismatch will cause tests/unit/observability-metrics.test.ts to fail once the test suite is executed. Update the assertion to look for "resource" (or rename the tag back to context) so the test reflects the current metric schema.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting

• @codex fix this CI failure
• @codex address that feedback