From f6b9c8e882d1c716e7bc906620bfcffd8e899bd1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Thu, 6 Aug 2026 05:07:27 +0200
Subject: [PATCH] fix(02-12): fail closed in record presentation

- retain elevated chrome only for internally consistent payloads\n- fall back to the caller record on malformed access entries
---
 src/lib/navigation/record-presentation.ts | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/src/lib/navigation/record-presentation.ts b/src/lib/navigation/record-presentation.ts
index 3922c0243..b9d0f378b 100644
--- a/src/lib/navigation/record-presentation.ts
+++ b/src/lib/navigation/record-presentation.ts
@@ -18,6 +18,21 @@ export interface RecordPresentation {
 export function resolveRecordPresentation(
   entry: Pick<AccountAccessEntry, "canWrite" | "level" | "recordKind">,
 ): RecordPresentation {
+  const validRecordKind =
+    entry.recordKind === "shared" || entry.recordKind === "managed";
+  const validAccess =
+    (entry.level === "read" && entry.canWrite === false) ||
+    ((entry.level === "write" || entry.level === "manage") &&
+      entry.canWrite === true);
+
+  // `parseAccountAccess` normally makes this branch unreachable. Keep the
+  // presentation boundary defensive anyway: a stale cache or an untyped
+  // consumer must never turn contradictory data into a stronger affordance or
+  // claim that the browser is inside somebody else's record.
+  if (!validRecordKind || !validAccess) {
+    return { access: "view", recordKind: "self" };
+  }
+
   return {
     access:
       entry.level === "manage"