Any catalogue user can publish an approved review from the Reviews page without moderation

[rubenvdlinde]

What goes wrong

Review moderation can be bypassed. The Reviews page in the main menu shows pending and rejected reviews to every catalogue group, and its Add form lets a user create a review with status approved, which makes it public straight away without an admin decision.

Evidence, re-read at c9760e0

The moderated path works as designed:

• The ReviewsPanel on ModuleDetail (src/manifest.json:514) submits through ReviewController, and lib/Service/ReviewService.php:232 forces status = pending whatever the client sends.
• Admins approve in the admin settings moderation queue (lib/Controller/ModerationController.php:81, #[AuthorizedAdminSetting]).

The generic path skips it:

• The Reviews page (src/manifest.json:805-823, route /reviews, menu entry at :128) is a plain type: index page on schema software-review with status as a column. Its create form writes through the OpenRegister objects API, not through ReviewService.
• lib/Settings/register.d/catalog-ratings.json, software-review.authorization: create is granted to ten catalogue groups (vng-raadpleger, software-catalog-users, ambtenaar, aanbod-beheerder and others). read gives anonymous callers only status: approved, but grants those same groups read on every review with no status condition, so pending and rejected reviews are listed to all of them.
• The status property is visible: true with enum pending, approved, rejected and no readOnly or hideOnForm. Its own description says it "is forced to 'pending' server-side by ReviewService regardless of client input", which is true only for the ReviewController path.
• No event listener in lib/ normalises status on an OpenRegister create of software-review.
• update is also granted to organisatie-beheerder, organisaties-beheerder and functioneel-beheerder on their own organisation's reviews, which would let them flip an existing review to approved.

Why it matters

Ratings are shown on the application page as approved-only averages (ReviewAggregateService), so a supplier's staff could publish their own five-star reviews, and reviewers' unmoderated text is visible to every signed-in catalogue user before an admin has looked at it.

Needs a live check

Code reading. Confirm by creating a review with status approved from /reviews as a non-admin catalogue user and reading it anonymously.

Surfaced by the capability matrix in stackiq#1072 (merge 38b9938), row mkt-review-moderation. Related: #481 (the moderation queues were unreachable because of CSRF).

[github-actions]

Thank you for opening this issue! It has been assigned to @rubenvdlinde for review.

What happens next:

1. A maintainer will review this issue and determine the appropriate action
2. If accepted, it may be converted into an OpenSpec change for structured development
3. You will be notified of any status changes

Triage labels:

• triage:accept-feature — accepted as a new feature
• triage:accept-bugfix — accepted as a bug fix
• triage:needs-info — more information needed
• triage:wontfix — will not be addressed
• triage:duplicate — duplicate of another issue