Issue #3611506: Requester and inbox access hardening: anonymous initiator, guarded outcomes, return target

Frank Mablyrequested to merge
issue/orchestra-3611506:3611506-requester-and-inbox into 1.x

Fixes the pre-alpha12 audit hardening findings for the requester and inbox surfaces.

  • S1: ProcessInstance::getInitiatorId()/setInitiatorId() and start() normalize the anonymous uid 0 to NULL (no initiator), so a stored 0 can never be owned by every anonymous visitor; InstanceInitiatorAccessCheck also denies anonymous outright (mirroring OperationAccessCheck).
  • S2: InboxController::complete() re-checks the guarded (requires_ui) outcome set and routes a hand-crafted complete?result= to the task surface instead of skipping the mandatory-input UI.
  • I2: InteractionTaskController preserves the orchestra_return target when a guarded outcome is opened, so completing it returns the operator where they came from. (The operation twin uses core's ?destination mechanism, left as-is.)

Kernel tests: the detail-view access matrix (owner, other user, anonymous, null-initiator, other-tenant), and the inbox complete route refusing a guarded outcome while still completing a non-guarded one.

Merge request reports