KPO Export RBAC Fix — MC #105326

KPO Export RBAC Fix — MC #105326

Finding

Proveo adversarial verify on MC #105321 (2026-07-12) found that GET /reports/kpo/export/pdf and GET /reports/kpo/export/xlsx in ReportRoutes.kt were missing the requirePermission(principal, "report:export") guard that every other export route (KIR, KPR, VAT, P&L, balance-sheet, accountant CSV package) already has. Git diff confirmed the gap pre-dated the T1b diff — it was a pre-existing asymmetry, not a regression.

Fix

Added if (requirePermission(principal, "report:export")) return@get to both KPO export routes in apps/api/src/main/kotlin/no/alai/bilko/routes/ReportRoutes.kt, matching the exact pattern used at the other 11 export-route call sites in the same file (13 total after the fix).

Tests

Added 4 integration tests to apps/api/src/test/kotlin/no/alai/bilko/routes/ReportRoutesHttpIntegrationTest.kt:

• GET reports kpo export pdf rejects viewer role with 403
• GET reports kpo export xlsx rejects viewer role with 403
• GET reports kpo export pdf allows owner role (passes RBAC, hits NotImplemented stub per MC #100038)
• GET reports kpo export xlsx allows owner role

Verified: ./gradlew integrationTest --tests "no.alai.bilko.routes.ReportRoutesHttpIntegrationTest" --rerun → BUILD SUCCESSFUL, 0 failures / 0 errors.

P2P Peer Verify

Proveo independent pre-verifier: PASS. mesh-thr-d41602c0-65fa-4d4c-bca4-8fe770f11704 / mesh-msg-e3c3869f-f160-4e65-a9d0-8ba27f000686. Transcript: /tmp/alai/p2p-pairing-evidence/mc105326-transcript.md.