fix(capture): require write access for board attachment

[Chris0Jeky]

Summary

Aligns capture creation with the existing triage authorization boundary:

• attaching a capture directly to a board now requires CanWriteBoardAsync rather than readable Viewer access;
• authorization lookup failures are propagated before any queue or durable-capture persistence;
• boardless capture behavior is unchanged;
• Owner/Admin/Editor semantics continue to come from the central authorization service.

A board-scoped capture can later enter that board's proposal queue, so this closes the create-time path that previously admitted a Viewer even though the equivalent triage-time link already required write access.

Tests

Adds focused Application coverage for:

1. readable-but-non-writable Viewer denial with no persistence;
2. write-authorization failure propagation with no persistence;
3. writable-board success without consulting the read predicate.

Adds authenticated SQLite/HTTP coverage proving:

4. a real Viewer receives the public 403 Forbidden contract and gets no capture row;
5. a real Editor can create the same board-scoped capture.

Verification

• Test-first Application commit: d9e791bb29694914a00e1631c86f069f2bd9abdf
• Test-first API commit: c31abe7d5ec3c8c726d711c07ba5eef66706cbbc
• Exact implementation head: a9ae7bb0f4fa17707d7af5ab10762da3ff4017cf
• Source diff is 7 additions / 2 deletions in CaptureService; no migration, DTO, route, proposal, or control-plane changes.
• Hosted exact-head CI and independent review are pending on this draft.

Closes #3291

[Chris0Jeky]

@codex address the exact-head CI failures without weakening the production write-authorization rule. The required corrections are bounded:

1. In CaptureServiceTests.cs, the three CreateAsync fixtures still configure CanReadBoardAsync; change only those setups to CanWriteBoardAsync (two true, one false). Leave the later triage test that deliberately configures read=true/write=false intact.
2. In CaptureServiceDualWriteTests.cs, the board-context fixture must configure CanWriteBoardAsync (already corrected at current branch head).
3. In CaptureBoardAttachmentAuthorizationApiTests.cs, keep auth stems within the username contract (already corrected at current branch head).
4. Rewrite CaptureApiTests.Triage_ShouldReturnForbidden_WhenAlreadyLinkedBoardIsReadOnlyForCaller: grant Editor, create the linked capture successfully, downgrade that access record to Viewer through PUT /api/boards/{boardId}/access/{accessId}, then assert bodyless triage returns 403 and persists no proposal. A Viewer creating an already-linked capture is no longer a valid setup after this PR.

Run the focused Application/API tests, then the exact-head matrix. Do not add compatibility fallbacks in production, skip tests, or restore read-only board attachment.

[chatgpt-codex-connector]

Summary

• Updated the three legacy CreateAsync test fixtures to configure CanWriteBoardAsync: two successful write authorizations and one denied authorization. The later intentional read=true/write=false triage fixture remains unchanged. backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.csL124-L135 backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.csL176-L187 backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.csL241-L259
• Reworked the already-linked read-only triage test to grant Editor access, successfully create the linked capture, downgrade the same access record to Viewer through the board-access API, and then verify bodyless triage returns 403 Forbidden. backend/tests/Taskdeck.Api.Tests/CaptureApiTests.csL889-L921
• Preserved the no-write behavior by verifying the capture stays pending and no automation proposal is persisted after forbidden triage. backend/tests/Taskdeck.Api.Tests/CaptureApiTests.csL923-L928
• Made no production-code changes or compatibility fallbacks. Committed the changes as 76f6e8a8 (test(capture): align authorization fixtures) and prepared the requested follow-up PR metadata.
• No canonical documentation was changed. The open maintainer-only and decision items in OUTSTANDING_TASKS.md remain outstanding.

Testing

• ✅ PATH=/tmp/dotnet:$PATH dotnet test backend/tests/Taskdeck.Application.Tests/Taskdeck.Application.Tests.csproj -c Release -m:1 --filter "FullyQualifiedName~CaptureServiceTests|FullyQualifiedName~CaptureServiceDualWriteTests" — 89 passed.
• ✅ PATH=/tmp/dotnet:$PATH dotnet test backend/tests/Taskdeck.Api.Tests/Taskdeck.Api.Tests.csproj -c Release -m:1 --filter "FullyQualifiedName~CaptureApiTests|FullyQualifiedName~CaptureBoardAttachmentAuthorizationApiTests" — 44 passed.
• ✅ PATH=/tmp/dotnet:$PATH dotnet test backend/Taskdeck.sln -c Release -m:1 — 10,165 passed and 34 environment-gated tests skipped; zero failures.
• ✅ git diff --check
• ✅ git status --short --branch — clean working tree on work.

View task →

[Chris0Jeky]

@codex publish the already-verified 76f6e8a8 changes directly onto this PR's existing head branch codex/3291-capture-board-write-auth. Do not open a separate PR or leave the commit only in the task worktree. After pushing, confirm the new GitHub head SHA so hosted exact-head CI can qualify it. Preserve the verified patch exactly: three CanWriteBoardAsync fixture updates plus the Editor-create/Viewer-downgrade triage regression, with no production fallback.

[chatgpt-codex-connector]

Summary

• Reproduced the verified patch on top of the existing PR head without changing production code:
  • Updated all three affected CreateAsync fixtures to use CanWriteBoardAsync, preserving the two successful authorizations and one denied authorization. backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.csL124-L129 backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.csL176-L181 backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.csL249-L254
  • Reworked the triage regression to grant Editor access, create the board-linked capture, downgrade the same access record to Viewer through the access endpoint, and then attempt bodyless triage. backend/tests/Taskdeck.Api.Tests/CaptureApiTests.csL888-L921
  • Preserved assertions that forbidden triage leaves the capture pending and persists no automation proposal. backend/tests/Taskdeck.Api.Tests/CaptureApiTests.csL923-L928
• Committed the patch locally as e88594fef5a8e35b70965f41901f85f79489675f (test(capture): align authorization fixtures).
• Publishing is blocked by missing GitHub credentials in this environment. The push was rejected before updating GitHub, so the existing remote PR head remains 325e1d5d3d0448424a7df042e8b22aaf592166b8; hosted exact-head CI has therefore not started for the follow-up commit.
• No canonical documentation was changed. The maintainer-only and decision items listed as unchecked in OUTSTANDING_TASKS.md remain open.

Testing

• ✅ git diff HEAD^ HEAD --check
• ✅ git show --stat --oneline HEAD
• ⚠️ dotnet test backend/tests/Taskdeck.Application.Tests/Taskdeck.Application.Tests.csproj -c Release -m:1 --filter "FullyQualifiedName~CaptureServiceTests|FullyQualifiedName~CaptureServiceDualWriteTests" — not run because dotnet is unavailable in this container.
• ⚠️ dotnet test backend/tests/Taskdeck.Api.Tests/Taskdeck.Api.Tests.csproj -c Release -m:1 --filter "FullyQualifiedName~CaptureApiTests|FullyQualifiedName~CaptureBoardAttachmentAuthorizationApiTests" — not run because dotnet is unavailable in this container.
• ❌ git push origin HEAD:refs/heads/codex/3291-capture-board-write-auth — failed with could not read Username for 'https://github.com': No such device or address.
• ✅ git ls-remote origin refs/heads/codex/3291-capture-board-write-auth — confirmed the unchanged GitHub head SHA is 325e1d5d3d0448424a7df042e8b22aaf592166b8.
• ✅ git status --short --branch — clean working tree after the local commit.

View task →

[Chris0Jeky]

@codex the verified fixture patch is still not on GitHub: this PR remains at 325e1d5. Apply the exact 76f6e8a8 diff to branch codex/3291-capture-board-write-auth now and push it. Do not create another PR or rerun the investigation. Reply with the published GitHub head SHA.

[chatgpt-codex-connector]

Summary

• Applied the verified fixture patch and committed it locally as 2ea13b272c8e267f7186dcfd765b75230c782407:
  • Updated the three affected CreateAsync fixtures to use CanWriteBoardAsync. backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.csL124-L129 backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.csL176-L181 backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.csL249-L254
  • Updated the triage regression to grant Editor access, create the linked capture, downgrade the access record to Viewer, and verify bodyless triage returns 403 without persisting a proposal. backend/tests/Taskdeck.Api.Tests/CaptureApiTests.csL889-L921 backend/tests/Taskdeck.Api.Tests/CaptureApiTests.csL923-L928
• The push could not authenticate because this environment has no GitHub credentials. Therefore, the published GitHub head remains 325e1d5d3d0448424a7df042e8b22aaf592166b8, not the local commit.
• No tests were rerun, as explicitly requested.

Testing / Publication

• ✅ git diff HEAD^ HEAD --check
• ✅ git status --short --branch — clean local branch codex/3291-capture-board-write-auth.
• ❌ git push origin HEAD:refs/heads/codex/3291-capture-board-write-auth — rejected with could not read Username for 'https://github.com': No such device or address.
• ✅ git ls-remote origin refs/heads/codex/3291-capture-board-write-auth — published GitHub head is still 325e1d5d3d0448424a7df042e8b22aaf592166b8.

View task →