# Security Audit Implementation — 2026-09-15

Fixes needed before adapter PR (brief-2 / brief-3) per AGENTS.md rule 7.

## 1. L2: AccessGrant join (AuthZ / IDOR)

Add `AccessGrant` join to `requireAccess` query pattern. Every protected resource must verify:
```sql
SELECT ... FROM resource r
LEFT JOIN access_grants ag ON ag.resource_id = r.id AND ag.user_id = ?
WHERE r.id = ? AND (ag.status = 'granted' OR r.owner_id = ?)
```

Files to edit:
- `lib/auth/requireAccess.ts`
- `tests/lib/auth/idor.spec.ts` (add regression assertions)

## 2. L5: Adapter isolation (disconnect-route)

Create / fix adapter-route so provider ref stays inside adapter:
- Route: `pages/api/auth/disconnect/route.ts`
- Adapter: `lib/auth-adapter/disconnect-adapter.js`
- Route must import ONLY adapter; adapter holds provider reference.