Ledger desk: the unguarded admin route

The Sabkha Freight ledger desk is a small staff web service in front of a records store. Its staff account list should be for administrators only, but the night shift saw it answered for callers who were not. Inspect the running service from the terminal, repair the access check without breaking what staff and administrators do every day, prove the repair, and write a rule that would have caught the incident in the access log.

The machine has three containers: the service you repair (your terminal opens there), an internal records store, and the platform's assurance agent. Two flags: the repair flag, which attest hands over once every check passes, and the detection flag, which detect hands over when your rule catches every misuse line in the incident log and its holdout and nothing else. Every name, organisation and address in the machine is fictional and generated for you.

Your terminal opens in the service container as ops. Edit the running copy of the service in /gen/app (start with /gen/app/server.py; /gen/data/accounts.txt has a staff account and an administrator account for testing); your generated data, including the incident log incident.jsonl, is in /gen/data. Run restart after an edit, check to see the table the platform grades, attest for the repair flag and reset to start again. A detection rule is JSON, {"match": "all", "conditions": [{"field": ..., "op": ..., "value": ...}]}, where op is equals, contains, in_set or count_over, match may also be any or {"n": 2}, and the fields are the keys of each log line except id; grade it with detect rule.json. attest and detect accept 20 attempts in five minutes.