TC-RBAC-004: PII Redaction & Permission Boundaries

🆕 New on stage — 2026-06-19 → 2026-07-01. This TC covers four hardening changes shipped this cycle: guest-registration PII/check-in-code redaction (#486), Platform Check-in access gated by PLATFORM_SUPPORT with 403-not-logout (#376/#377), member-role allowlist rejection (#389–#395), and bank-accounts view for ADMIN/OFFICER/FINANCE_MANAGER via an additive backfill (#363/#372). See the Test Plan banner and the Jun 19 release notes.

Module: RBAC — PII Redaction & Permission Boundaries

Primary Test Users: testmember@rcme.membervu.com / Member123! (non-privileged); admin@rcme.membervu.com / Admin123!; events@demo.membervu.com / Events123! (EVENT_MANAGER); superadmin@zeniark.com / SuperAdmin123!

Priority: P1 (security / PII exposure)

Objectives

As a non-privileged caller (plain MEMBER, no EVENTS:VIEW:registrations), confirm the guest-registration roster (GET /api/events/:eventId/registrations/guests) omits attendeeEmail/memberEmail/guestEmail/checkInCode/displayTicketCode/invoice/invitedBy.email for other attendees' rows, while retaining those fields for the caller's own registration (#486).
Confirm a privileged caller (ADMIN or EVENT_MANAGER, holding EVENTS:VIEW:registrations) sees the full, unredacted roster for every row.
As a platform user without PLATFORM_SUPPORT/SUPER_ADMIN, confirm the admin portal's Tenant Detail → Events tab / Event Attendees page returns 403 and does NOT log the operator out (#376/#377).
Confirm PUT /api/membership/members/:id/roles rejects a non-allowlisted role code (platform code or arbitrary string) with 400 (#389–#395).
Confirm ADMIN, OFFICER, and FINANCE_MANAGER can all view bank accounts (FINANCE:VIEW:bank-accounts), landed via an additive permission backfill (#363/#372).

Scenario summary

ID	Scenario	Key data assertion
RB4-01	Non-privileged caller — other attendee's row is redacted	Response row for another attendee has NO `attendeeEmail`/`memberEmail`/`guestEmail`/`checkInCode`/`displayTicketCode` keys; `invoice` is `null`.
RB4-02	Non-privileged caller — own row keeps sensitive fields	The caller's own registration row still has `checkInCode`, `displayTicketCode`, and their own email populated.
RB4-03	Privileged caller — full roster	Every row (self, others, guests) carries `checkInCode` and email fields; `invoice` populated.
RB4-04	Guest row `invitedBy.email` redaction	Non-privileged: `invitedBy` has `id`/`firstName`/`lastName` but NO `email` key. Privileged: `invitedBy.email` present.
RB4-05	`PLATFORM_SUPPORT`-gated admin-portal route → 403, not logout	A platform user lacking both `PLATFORM_SUPPORT` and `SUPER_ADMIN` gets `403` from `/api/platform/tenants/:slug/events`; the admin-portal session stays authenticated (no forced redirect to `/login`).
RB4-06	Role-assignment allowlist rejection	`PUT /api/membership/members/:id/roles` with a platform code (`SUPER_ADMIN`) or garbage string → `400 VALIDATION_ERROR`, member's stored roles unchanged.
RB4-07	Bank-accounts view — ADMIN/OFFICER/FINANCE_MANAGER allowed	All three roles get `200` on the bank-accounts view endpoint; a role without the grant (e.g. EVENT_MANAGER) gets `403`.

➡️ Full click-by-click steps: TC-RBAC-004 (Detailed).