The Permission That Outlived the User

Offboarding ticket closes at 16:02. IdP says access gone. At 16:11 the contractor's token still deletes a project. The auth service is 'healthy'. The cache layer never heard about the revocation.

Initial failing signalRevoked admin still authorizesExpected behavior: A revoked admin is denied authorization. · actual behavior: A revoked admin is still authorized.

Progress

1Reproduce the bugRun checks

2Edit the fixOpen

3Pass checksOpen

4Submit fixOpen

Reproduction Steps

Prime a user as admin.
Confirm authorize returns true.
Call revokeAccess.
Authorize again — it should be false.

Focus Mode

Start

src/gateway.ts
src/authorize.ts

Likely area

src/authorize.ts
src/gateway.ts
src/session.ts

Challenge Coach

Hints reveal broad direction first, then narrow toward the suspect path without showing hidden tests or exact solution code.

TopicSecrets & Auth

DifficultyMedium

Est. time15 min

Workspacepreparing

Explorer

Loading files

Evidence Map

Failing signal loaded from challenge API
Workspace files loaded from workspace API
Results rendered only after API run/submit

Autosaved

workspace

Outputread-onlyready$ prepare workspace

Preparing workspace