fix(auth): authorize project-member collections against requested project

COMPATIBILITY.md

@@ -58,6 +58,12 @@ being weakened by a later `member` grant. The release gate exercises this
 ordering with a deterministic barrier for 100 iterations and separately covers
 `shared`, `personal`, `none`, invalid-mode, and legacy-disabled behavior.
 
+Release `0.183.320` preserves these roles and membership-write semantics. It
+only requires the token policy to authorize the *queried* project before a
+`projectMembers?projectId=` collection is loaded. A selected-project request
+header cannot authorize reading another project's member list; both v1 and
+v2-beta use the same check.
+
 ## External identity type upgrades
 
 `oidc_user` and `oidc_group` are built-in OpenID Connect identity types. An

README.md

@@ -9,8 +9,8 @@ PastureStack is an independent community effort to preserve, audit, and moderniz
 ## Project status
 
 The current public GitHub Release
-[`v0.183.319`](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.319)
-produces engine version `0.183.319`. It retains the existing Java 25, Ubuntu
+[`v0.183.320`](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.320)
+produces engine version `0.183.320`. It retains the existing Java 25, Ubuntu
 26.04, Maven, Liquibase, MariaDB/MySQL, WebSocket, dependency, concurrency, and
 runtime-hardening work from the maintained compatibility line. Release builds
 consume the exact `5.7.4` runtime JAR published by
@@ -21,6 +21,14 @@ product identity and provenance are carried by the artifact name, metadata,
 SBOM, and release evidence. Provenance and scope are documented in
 [`third-party/HAZELCAST.md`](third-party/HAZELCAST.md).
 
+Release `0.183.320` checks the requested project against the token's project
+access before loading a `projectMembers?projectId=` collection. This closes a
+cross-project read path when a valid `X-API-Project-Id` header and a different
+query `projectId` are supplied together. Both v1 and v2 API routes share the
+same resource manager; malformed project IDs fail without loading members.
+See [the release note](docs/releases/orchestration-engine-0.183.320.md) for
+scope and verification.
+
 Release `0.183.319` makes shared Default membership reconciliation atomic. The
 Engine now checks every authenticated direct and group identity and creates the
 stable account membership while holding the same project lock, so a concurrent
@@ -241,7 +249,7 @@ The gate performs dependency-hygiene checks, builds every Maven module with JDK
 To create the complete release archive after the gate passes:
 
 ```sh
-ENGINE_VERSION=0.183.319 bash scripts/build --release
+ENGINE_VERSION=0.183.320 bash scripts/build --release
 bash scripts/check-release-artifact dist/artifacts/cattle.jar
 ```
 

code/framework/api-pub-sub-jetty/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/api-pub-sub/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/api/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/archaius/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-meta-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../meta-parent/pom.xml</relativePath>
     </parent>
 </project>

code/framework/async/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/auditing/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
 

code/framework/db-loader/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/deferred/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/encryption/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/engine/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/eventing/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/events/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/extension-spring/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/extension/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/java-server/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/jmx/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/jooq/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/json/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/launcher/pom.xml

@@ -4,7 +4,7 @@
 	<parent>
 		<groupId>io.cattle</groupId>
 		<artifactId>cattle-parent</artifactId>
-		<version>0.183.319</version>
+		<version>0.183.320</version>
     <relativePath>../../parent/pom.xml</relativePath>
 	</parent>
 	<dependencies>

code/framework/lock/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/logback/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-meta-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../meta-parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/managed-context/pom.xml

@@ -4,7 +4,7 @@
   <parent>
     <groupId>io.cattle</groupId>
     <artifactId>cattle-parent</artifactId>
-    <version>0.183.319</version>
+    <version>0.183.320</version>
     <relativePath>../../parent/pom.xml</relativePath>
   </parent>
   <dependencies>

code/framework/metrics/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/module/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/object/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/pool/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/resource-monitor/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/schema/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/server/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-meta-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../meta-parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/spring/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/system-task/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/token/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/utils/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/iaas/agent-instance/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/iaas/agent-server/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/iaas/agent/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/iaas/allocator/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/iaas/api-logic/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/iaas/archaius-management/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.319</version>
+        <version>0.183.320</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>