TextAreaView offers editable course exercise fields to users without Update permission, failing on save

[systemorph-com]

What is failing

The portal's TextAreaView (course exercise page) presents editable answer fields (Write/Answer1, Write/Answer2) to an unauthenticated ("Anonymous") visitor, and the server-side save throws System.UnauthorizedAccessException because that user lacks Update permission on the target book node. The failure surfaces as a raw logged exception rather than a graceful, permission-aware UI.

Probable cause

Two candidate causes, in order of likelihood:

1. Missing write-permission preflight in TextAreaView (high confidence the code path is missing a check): the view renders/accepts input without verifying Update permission on the underlying node, so unauthenticated users can attempt a save that is guaranteed to fail. The save handler then lets the UnauthorizedAccessException escape to the logger instead of disabling the editor or showing a permission message.
2. Misconfigured permissions on the course content (possible contributor): AgenticPrimer/01-TheMagicWish/Exercise/ThreeWishesBook may be intended to be writable by exercise participants, but the Anonymous/course role has no Update grant — i.e. a content-config bug rather than a code bug.

The evidence cannot distinguish between a view that should disable editing vs. content that should grant access; both should be checked starting from the same place.

Impact

Small and contained: 4 occurrences, one portal pod, within a ~0.4-second window (looks like one visitor triggering saves on two fields, each logged twice — likely a retried/double-triggered save). No data loss or corruption; the writes were correctly rejected. The user-visible effect is a broken/blank exercise experience for unauthenticated visitors of the AgenticPrimer course.

Where to look

• MeshWeaver.Blazor.EntityViews.TextAreaView — the save handler behind the Saving '{value}' in Area {path} log site; add an Update-permission check before rendering the editor, and catch UnauthorizedAccessException in the save path to degrade gracefully.
• The permissions/ACL configuration on AgenticPrimer/01-TheMagicWish/Exercise/ThreeWishesBook (and its exercise siblings) — verify what Update grants the Anonymous/course-participant role is supposed to have.
• The per-instance detail is: user Anonymous, target AgenticPrimer/01-TheMagicWish/Exercise/ThreeWishesBook, areas Write/Answer1 and Write/Answer2.

---

Evidence

Fingerprint	b35ae54676dfaf30
Category	MeshWeaver.Blazor.EntityViews.TextAreaView
Severity	Error
Exception	System.UnauthorizedAccessException
Namespace	memex-cloud
Pods	memex-portal-deployment-7d7f4d84f9-n7g6b
Occurrences	4
First seen	2026-09-23 18:01:05Z
Last seen	2026-09-23 18:01:06Z
Routing	not determined — no configured route matches the category MeshWeaver.Blazor.EntityViews.TextAreaView. This repository is the configured fallback, not a finding about who owns the fault; the category names the LOGGER, which may not be the subject.

Recent log lines

2026-09-23 18:01:05Z memex-portal-deployment-7d7f4d84f9-n7g6b fail: MeshWeaver.Blazor.EntityViews.TextAreaView[0]
      Saving 'answer1' in Area Write/Answer1
      System.UnauthorizedAccessException: Access denied: user 'Anonymous' lacks Update permission on 'AgenticPrimer/01-TheMagicWish/Exercise/ThreeWishesBook'
2026-09-23 18:01:05Z memex-portal-deployment-7d7f4d84f9-n7g6b fail: MeshWeaver.Blazor.EntityViews.TextAreaView[0]
      Saving 'answer1' in Area Write/Answer1
      System.UnauthorizedAccessException: Access denied: user 'Anonymous' lacks Update permission on 'AgenticPrimer/01-TheMagicWish/Exercise/ThreeWishesBook'
2026-09-23 18:01:06Z memex-portal-deployment-7d7f4d84f9-n7g6b fail: MeshWeaver.Blazor.EntityViews.TextAreaView[0]
      Saving 'answer2' in Area Write/Answer2
      System.UnauthorizedAccessException: Access denied: user 'Anonymous' lacks Update permission on 'AgenticPrimer/01-TheMagicWish/Exercise/ThreeWishesBook'
2026-09-23 18:01:06Z memex-portal-deployment-7d7f4d84f9-n7g6b fail: MeshWeaver.Blazor.EntityViews.TextAreaView[0]
      Saving 'answer2' in Area Write/Answer2
      System.UnauthorizedAccessException: Access denied: user 'Anonymous' lacks Update permission on 'AgenticPrimer/01-TheMagicWish/Exercise/ThreeWishesBook'

_{Opened automatically from Admin/_LogIncident/b35ae54676dfaf30. Recurrences are folded into this issue rather than opening new ones.}

[systemorph-com]

Still occurring: 2 more since the last update (6 total).

• Last seen: 2026-09-23 18:55:01Z
• Pods: memex-portal-deployment-7d7f4d84f9-n7g6b, memex-portal-deployment-6f497dc9b-j9vq8

Recent log lines

2026-09-23 18:01:06Z memex-portal-deployment-7d7f4d84f9-n7g6b fail: MeshWeaver.Blazor.EntityViews.TextAreaView[0]
      Saving 'answer2' in Area Write/Answer2
      System.UnauthorizedAccessException: Access denied: user 'Anonymous' lacks Update permission on 'AgenticPrimer/01-TheMagicWish/Exercise/ThreeWishesBook'
2026-09-23 18:55:01Z memex-portal-deployment-6f497dc9b-j9vq8 fail: MeshWeaver.Blazor.EntityViews.TextAreaView[0]
      Saving 'answer4' in Area Write/Answer4
      System.UnauthorizedAccessException: Access denied: user 'Anonymous' lacks Update permission on 'AgenticPrimerDe/01-Zauberwunsch/Exercise/DreiWuenscheBuch'
2026-09-23 18:55:01Z memex-portal-deployment-6f497dc9b-j9vq8 fail: MeshWeaver.Blazor.EntityViews.TextAreaView[0]
      Saving 'answer4' in Area Write/Answer4
      System.UnauthorizedAccessException: Access denied: user 'Anonymous' lacks Update permission on 'AgenticPrimerDe/01-Zauberwunsch/Exercise/DreiWuenscheBuch'

[rbuergi]

Two halves: the content root is already fixed, and the platform half is in flight

Root (content): fixed in MeshWeaver.Education#366 (be03dee1, merged 2026-09-23 21:08Z, Education#363).

• The boxes come from the in-mesh area AgenticPrimer/WishBook → WishBookAreas.Write, and from its DE twin. The area now folds GetEffectivePermissions(...).HasFlag(Update) into its structure.
• Without Update, the boxes are Readonly, and the saved-count line becomes a line that says where writing works.
• Both samples here (18:01Z and 18:55Z) are from before that merge.
• Not live until the portals pick up the new publication and the AgenticPrimer/WishBook / AgenticPrimerDe/WishBook activations are recycled. That is an owner action.

Platform half (this repo + Plugins). A node-bound write that is refused anyway was handed to SurfaceError. That produced an Error line (this ticket) and the raw English exception in the modal.

• Core fix(i18n): a refused node-bound field write has a localized sentence (#5600) #5639 adds the catalog sentence ui.fieldWriteRefused (en + de) and states the rule in Doc/GUI/DataBinding.
• Plugins#2342 routes an access refusal (AreaErrorClassifier.IsAccessDenied) through SurfaceRefusal (Warning) with that sentence.
• NodeBoundWriteRefusalTest runs a real view with a real RLS refusal. Before the fix the sink read Saving 'answer1': Access denied: user 'wish-viewer' lacks Update permission on …, and 2 of 3 cases failed. After the fix all 3 pass: en and de each show the sentence, and the positive control (an editor's write lands) is green.

Owner decision, not code: should an anonymous visitor be able to keep answers on the course's own copy at all? Today the course copy grants visitors Viewer only, by design, and the page points them to Install. Nothing here changes that grant.