fix: remove ABAC

Author: CasLubbers

README.md

@@ -57,7 +57,7 @@ npm run build:spec   # Build OpenAPI specification
 
 - **Git-as-Database**: All configuration stored as YAML in Git repository
 - **OpenAPI-First**: All endpoints auto-generated from `src/openapi/*.yaml` specs
-- **Multi-Tenant**: Team isolation with RBAC/ABAC authorization
+- **Multi-Tenant**: Team isolation with RBAC authorization
 - **Real-time**: WebSocket updates for live status monitoring
 
 ### Key Components
@@ -79,7 +79,7 @@ npm run build:spec   # Build OpenAPI specification
 - **Headers required**: `Authorization`, `Auth-Group`
 - **Mock users** available for testing
 
-### Authorization (RBAC + ABAC)
+### Authorization (RBAC)
 
 - **platformAdmin**: Full system access
 - **teamAdmin**: Manage own team resources

src/authz.test.ts

@@ -267,34 +267,6 @@ describe('Platform admin, team admin and team member scenarios', () => {
   })
 })
 
-describe('ABAC attribute denial', () => {
-  const spec: OpenAPIDoc = {
-    components: {
-      schemas: {
-        Team: { type: 'object', 'x-acl': { teamMember: ['update'] }, properties: {} },
-      },
-    },
-    paths: {},
-    security: [],
-  }
-  const teamId = 'teamA'
-  let authz: Authz
-  beforeEach(() => {
-    authz = new Authz(spec).init(sessionTeam)
-    sessionTeam.authz = { [teamId]: { deniedAttributes: { Team: ['foo', 'bar'] } } }
-  })
-  test('Denied attributes are respected', () => {
-    expect(() => authz.hasSelfService(teamId, 'foo')).not.toThrow()
-    expect(() => authz.hasSelfService(teamId, 'bar')).not.toThrow()
-  })
-  test('Allowed attribute is not denied', () => {
-    expect(() => authz.hasSelfService(teamId, 'baz')).not.toThrow()
-  })
-  afterEach(() => {
-    sessionTeam.authz = {}
-  })
-})
-
 describe('Fallback to CASL when no self-service permission', () => {
   const spec: OpenAPIDoc = {
     components: {

src/middleware/authz.ts

@@ -11,7 +11,7 @@ const HttpMethodMapping: Record<string, string> = {
 }
 
 /**
- * Authorize a request based on RBAC and ABAC rules.
+ * Authorize a request based on RBAC rules.
  * Called by the security handler.
  * Throws HttpError if authorization fails.
  */