no-admin-idor: 4 controllers lack in-body guards

[rubenvdlinde]

Hydra gate-7 (no-admin-idor) flags 4 pre-existing controller methods without per-object/admin guards, surfaced during #10 review:

• lib/Controller/ActivityTimelineController.php:59
• lib/Controller/HealthController.php:70
• lib/Controller/MetricsController.php:70
• lib/Controller/RoutingController.php:65

Each is #[NoAdminRequired] without an in-body authorization guard (potential IDOR / OWASP A01). Verify whether each genuinely needs object-level authz or is safe by design, and add guards or document the exemption.

---

Gemigreerd van Codeberg — oorspronkelijk Conduction/pipelinq#12, geopend door rubenvdlinde op 2026-05-31.

[github-actions]

Thank you for opening this issue! It has been assigned to @rubenvdlinde for review.

What happens next:

1. A maintainer will review this issue and determine the appropriate action
2. If accepted, it may be converted into an OpenSpec change for structured development
3. You will be notified of any status changes

Triage labels:

• triage:accept-feature — accepted as a new feature
• triage:accept-bugfix — accepted as a bug fix
• triage:needs-info — more information needed
• triage:wontfix — will not be addressed
• triage:duplicate — duplicate of another issue