fix(permissions): admin can no longer operate tests — start/submit/edit/create, view only

Admin still bypassed require_any_role (non-strict) on the pure
operator actions: start-execution, submit-red, start-blue-work,
submit-blue, pause/resume-timer, and the red/blue field-edit + general
test create/update/remediation/import-rt/template endpoints all used
the loose dependency even where admin wasn't in the role tuple.
Switched every one of these to require_any_role_strict, matching the
review/validate/dispute/hold/assign endpoints already fixed earlier.

Frontend: removed every remaining role === "admin" disjunct gating
Start Execution, Submit to Blue Team, blue evaluating actions, timer
control, red/blue field editing, test creation, and template creation.
Team-blindness visibility (isBlind) deliberately keeps the admin
bypass — admin still sees both sides unmasked for oversight, since
that's visibility, not operating.

Updated ~20 tests whose fixtures used the admin account as a
convenience shortcut to create/drive tests through the workflow —
switched them to a red_lead account, fixing an incidental
fixture-resolution-order cookie bug along the way (client's cookie
jar prefers the last-logged-in role's cookie over any Bearer header
explicitly passed to a later request).

backend/app/routers/test_templates.py

@@ -37,8 +37,8 @@ from sqlalchemy.orm import Session
 # Import get_db from app.database
 from app.database import get_db
 
-# Import get_current_user, require_any_role from app.dependencies.auth
-from app.dependencies.auth import get_current_user, require_any_role
+# Import get_current_user, require_any_role_strict from app.dependencies.auth
+from app.dependencies.auth import get_current_user, require_any_role_strict
 
 # Import UnitOfWork from app.domain.unit_of_work
 from app.domain.unit_of_work import UnitOfWork
@@ -167,7 +167,7 @@ def template_stats(
     # Entry: db
     db: Session = Depends(get_db),
     # Entry: current_user
-    current_user: User = Depends(require_any_role("red_lead", "blue_lead")),
+    current_user: User = Depends(require_any_role_strict("red_lead", "blue_lead")),
 ) -> dict:
     """Return catalog statistics: active, by_source, by_platform.
 
@@ -195,7 +195,7 @@ def bulk_activate_templates(
     # Entry: db
     db: Session = Depends(get_db),
     # Entry: current_user
-    current_user: User = Depends(require_any_role("red_lead", "blue_lead")),
+    current_user: User = Depends(require_any_role_strict("red_lead", "blue_lead")),
 ) -> dict:
     """Set all templates to active or inactive.
 
@@ -317,7 +317,7 @@ def create_template(
     # Entry: db
     db: Session = Depends(get_db),
     # Entry: current_user
-    current_user: User = Depends(require_any_role("red_lead", "blue_lead")),
+    current_user: User = Depends(require_any_role_strict("red_lead", "blue_lead")),
 ) -> TestTemplateOut:
     """Create a custom test template.
 
@@ -386,7 +386,7 @@ def update_template(
     # Entry: db
     db: Session = Depends(get_db),
     # Entry: current_user
-    current_user: User = Depends(require_any_role("red_lead", "blue_lead")),
+    current_user: User = Depends(require_any_role_strict("red_lead", "blue_lead")),
 ) -> TestTemplateOut:
     """Update fields of an existing test template.
 
@@ -439,7 +439,7 @@ def toggle_template_active(
     # Entry: db
     db: Session = Depends(get_db),
     # Entry: current_user
-    current_user: User = Depends(require_any_role("red_lead", "blue_lead")),
+    current_user: User = Depends(require_any_role_strict("red_lead", "blue_lead")),
 ) -> TestTemplateOut:
     """Toggle a template between active and inactive (is_active = not is_active).
 
@@ -491,7 +491,7 @@ def delete_template(
     # Entry: db
     db: Session = Depends(get_db),
     # Entry: current_user
-    current_user: User = Depends(require_any_role("red_lead", "blue_lead")),
+    current_user: User = Depends(require_any_role_strict("red_lead", "blue_lead")),
 ) -> dict:
     """Soft-delete a test template by setting ``is_active=False``.
 

backend/app/routers/tests.py

@@ -42,7 +42,7 @@ from sqlalchemy.orm import Session
 from app.database import get_db
 
 # Import get_current_user, require_any_role from app.dependencies.auth
-from app.dependencies.auth import get_current_user, require_any_role, require_any_role_strict
+from app.dependencies.auth import get_current_user, require_any_role_strict
 
 # Import UnitOfWork from app.domain.unit_of_work
 from app.domain.unit_of_work import UnitOfWork
@@ -331,7 +331,7 @@ def create_test(
     # Entry: db
     db: Session = Depends(get_db),
     # Entry: current_user
-    current_user: User = Depends(require_any_role("red_lead", "blue_lead")),
+    current_user: User = Depends(require_any_role_strict("red_lead", "blue_lead")),
 ) -> TestOut:
     """Create a new test linked to an existing technique.
 
@@ -411,7 +411,7 @@ def create_test_from_template(
     # Entry: db
     db: Session = Depends(get_db),
     # Entry: current_user
-    current_user: User = Depends(require_any_role("red_lead", "blue_lead")),
+    current_user: User = Depends(require_any_role_strict("red_lead", "blue_lead")),
 ) -> TestOut:
     """Instantiate a real Test from an existing TestTemplate.
 
@@ -527,11 +527,12 @@ def update_test(
     # Entry: db
     db: Session = Depends(get_db),
     # Entry: current_user
-    current_user: User = Depends(require_any_role("red_lead", "blue_lead")),
+    current_user: User = Depends(require_any_role_strict("red_lead", "blue_lead")),
 ) -> TestOut:
     """Update one or more fields of an existing test.
 
-    Only leads or admins can update general test fields.
+    Only leads can update general test fields — admin administers the
+    site, not test content.
     The test must be in ``draft`` or ``rejected`` state.
 
     Args:
@@ -658,7 +659,7 @@ def update_test_red(
     # Entry: db
     db: Session = Depends(get_db),
     # Entry: current_user
-    current_user: User = Depends(require_any_role("red_tech", "red_lead")),
+    current_user: User = Depends(require_any_role_strict("red_tech", "red_lead")),
 ) -> TestOut:
     """Red Team updates their fields (allowed in ``draft`` and ``red_executing``).
 
@@ -724,7 +725,7 @@ def update_test_blue(
     # Entry: db
     db: Session = Depends(get_db),
     # Entry: current_user
-    current_user: User = Depends(require_any_role("blue_tech", "blue_lead")),
+    current_user: User = Depends(require_any_role_strict("blue_tech", "blue_lead")),
 ) -> TestOut:
     """Blue Team updates their fields (allowed only in ``blue_evaluating``).
 
@@ -788,7 +789,7 @@ def start_execution(
     # Entry: db
     db: Session = Depends(get_db),
     # Entry: current_user
-    current_user: User = Depends(require_any_role("red_tech", "red_lead")),
+    current_user: User = Depends(require_any_role_strict("red_tech", "red_lead")),
 ) -> TestOut:
     """Move a test from ``draft`` to ``red_executing``.
 
@@ -839,7 +840,7 @@ def submit_red(
     # Entry: db
     db: Session = Depends(get_db),
     # Entry: current_user
-    current_user: User = Depends(require_any_role("red_tech", "red_lead")),
+    current_user: User = Depends(require_any_role_strict("red_tech", "red_lead")),
 ) -> TestOut:
     """Red Team finalises — move from ``red_executing`` to ``blue_evaluating``.
 
@@ -887,7 +888,7 @@ def submit_blue(
     # Entry: db
     db: Session = Depends(get_db),
     # Entry: current_user
-    current_user: User = Depends(require_any_role("blue_tech", "blue_lead")),
+    current_user: User = Depends(require_any_role_strict("blue_tech", "blue_lead")),
 ) -> TestOut:
     """Blue Team finalises — move from ``blue_evaluating`` to ``in_review``.
 
@@ -931,7 +932,7 @@ def submit_blue(
 def start_blue_work(
     test_id: uuid.UUID,
     db: Session = Depends(get_db),
-    current_user: User = Depends(require_any_role("blue_tech", "blue_lead")),
+    current_user: User = Depends(require_any_role_strict("blue_tech", "blue_lead")),
 ):
     """Blue tech picks up the test to start evaluating. Sets the Tempo timer start."""
     test = crud_get_test_or_raise(db, test_id)
@@ -1029,7 +1030,7 @@ def pause_timer(
     # Entry: db
     db: Session = Depends(get_db),
     # Entry: current_user
-    current_user: User = Depends(require_any_role("red_tech", "blue_tech", "red_lead", "blue_lead")),
+    current_user: User = Depends(require_any_role_strict("red_tech", "blue_tech", "red_lead", "blue_lead")),
 ) -> TestOut:
     """Pause the running timer for the current phase (red_executing or blue_evaluating).
 
@@ -1068,7 +1069,7 @@ def resume_timer(
     # Entry: db
     db: Session = Depends(get_db),
     # Entry: current_user
-    current_user: User = Depends(require_any_role("red_tech", "blue_tech", "red_lead", "blue_lead")),
+    current_user: User = Depends(require_any_role_strict("red_tech", "blue_tech", "red_lead", "blue_lead")),
 ) -> TestOut:
     """Resume the paused timer for the current phase.
 
@@ -1446,7 +1447,7 @@ def update_remediation(
     # Entry: db
     db: Session = Depends(get_db),
     # Entry: current_user
-    current_user: User = Depends(require_any_role("red_lead", "blue_lead")),
+    current_user: User = Depends(require_any_role_strict("red_lead", "blue_lead")),
 ) -> TestOut:
     """Update remediation fields on a test.
 
@@ -1800,13 +1801,13 @@ class RTImportPayload(BaseModel):
 def import_rt(
     payload: RTImportPayload,
     db: Session = Depends(get_db),
-    current_user: User = Depends(require_any_role("red_lead")),
+    current_user: User = Depends(require_any_role_strict("red_lead")),
 ):
     """Import results from a real Red Team engagement.
 
     Creates one Test record per technique in ``validated`` state (bypassing
     the normal Red/Blue workflow) and immediately recalculates coverage metrics.
-    Requires ``red_lead`` or ``admin`` role.
+    Requires ``red_lead`` — admin administers the site, not test content.
     """
     # Pre-validate: every technique must include at least one evidence image
     for entry in payload.techniques: