feat: add target-aware RBAC authorization to Scheduled Operations (#1745)

* feat: add target-aware RBAC authorization to Scheduled Operations

Replace the blanket requireAdmin gate on all 9 scheduled-tasks endpoints
with per-action permission checks derived from the centralized action
registry. Each scheduled action now declares the existing permission it
requires: stack lifecycle actions need stack:deploy on the target stack,
node-wide operations need node:manage on the target node, prune stays
admin-only via system:settings, and snapshot requires unscoped
node:manage.

Key changes:
- Backend registry: add permission field and resolveTaskPermissionScope
- Routes: replace requireAdmin with requireTaskPermission, filter GET
  listing by permission, add two-phase PUT check
- Scheduler: revalidate creator permission at execution time, auto-disable
  on revocation (TaskAuthorizationError)
- Database: new creator_user_id column with migration and backfill
- Frontend: canScheduleAction/canScheduleAny helpers, reachability gate
  via scheduledOpsAccessible, stack context menu uses canDeploy
  not isAdmin, permissions field on all ScheduledActionDefinitions
- Expose checkPermissionForSubject for in-process callers (scheduler)

No new PermissionAction values are added. Uses the existing stack:deploy,
node:manage, and system:settings matrix. Scoped Admiral grants work on the
exact (nodeId, stackName) target per SEN-438.

* test: add RBAC coverage for scheduled operations authorization

* test: update frontend tests for scheduled-ops RBAC gate changes

- useStackMenuItems: gate Schedule task on canDeploy not isAdmin;
  add test for canDeploy=true, non-admin case
- buildNavigationModel: default scheduledOpsAccessible to true
  (default ctx is admin, who can always schedule)
- useViewNavigationState: add stack:deploy to admin can() mocks
  so canScheduleAny resolves correctly

* fix: keep checkPermission unchanged, add checkPermissionForSubject standalone

The earlier refactoring that made checkPermission delegate to
checkPermissionForSubject changed the call order of effectiveTier(req)
relative to the admin bypass, which subtly broke the Community tier
clamping in the audit-log route. Keep checkPermission byte-identical
to the original and expose checkPermissionForSubject as a standalone
function used only by the scheduler revalidation path.

* fix: prefix unused selectorType parameter in resolveTaskPermissionScope

* fix: address audit findings — existence oracle, revalidation test, action filtering

Three corrections from the independent PR audit:

RC-1 (action filtering): Wire canScheduleActionAnywhere into the action
picker in ScheduledOperationsView so actions the user can never schedule
(prune without system:settings, node:manage actions without a scoped
grant) are filtered from the picker entirely. Add canScheduleAction
check on the Create button against the currently selected target, so
the submit button is disabled when the caller cannot schedule the
chosen action on the chosen target.

RC-2 (existence oracle): Six by-ID endpoints (GET /:id, DELETE /:id,
PATCH /:id/toggle, POST /:id/run, GET /:id/runs/export, GET /:id/runs)
now return a uniform 404 when permission is denied on an existing task,
so an unauthorized caller cannot distinguish "task does not exist" from
"task exists but you are not authorized." Added
requireTaskExistsPermission helper for the 404 variant; POST create and
PUT merged-scope checks keep requireTaskPermission (403).

RC-3 (revalidation test): Fixed the orphan-creator test to assert the
post-execution task state (auto-disabled, explicit error message) rather
than wrapping executeTask in a try/catch with a no-op else branch, since
executeTask catches TaskAuthorizationError internally and returns
normally.

Added canScheduleActionAnywhere helper and AuthContext mock to
ScheduledOperationsView tests (38/38 pass).

* fix: remove unused TaskAuthorizationError import from test

* fix: use 404 on PUT phase-1 unauthorized-access check

The PUT two-phase check's first phase (ownership verification)
now uses requireTaskExistsPermission (404) instead of a manual
403, consistent with the six other by-ID endpoints. This prevents
a caller from probing task-ID existence via the PUT route.

* fix: address QA findings — reorder prechecks, surface permission reason

Two live-confirmed fixes from the 3-node fleet QA pass:

Finding #4 (offline-node error ordering): Swap the order of the node-
reachability precheck and the creator-permission revalidation in
SchedulerService.executeTask. Authorization now runs first, so a
revoked grant is always surfaced as an explicit auto-disable with a
clear error message, even when the target node is offline. Previously
the reachability check ran first, hiding the revocation behind a
misleading "target node is offline" error and leaving the task enabled
indefinitely while the node was down.

Finding #7 (unexplained Save dead-end): When the Create/Update button
is disabled because canScheduleAction denies the selected action-target
combination, a muted text line now appears below the button:
"You do not have permission to schedule this action on the selected
target." This gives scoped users meaningful feedback instead of a
silently disabled button with no explanation.

* chore: remove redundant !!formName guards

The earlier short-circuit conditions in isSaveDisabled and
saveDisabledReason already guarantee formName is truthy by the
time the canSaveWithCurrentTarget check runs. The !!formName
guard is a no-op — flagged by GitHub code-quality as 'Useless
conditional: This negation always evaluates to true.'

backend/src/__tests__/scheduled-tasks-rbac.test.ts

@@ -0,0 +1,456 @@
+/**
+ * RBAC tests for /api/scheduled-tasks. Verifies that target-aware permission
+ * checks replace the blanket requireAdmin gate: scoped deployers can create
+ * stack-lifecycle schedules for their stacks, node admins can create node-wide
+ * schedules, viewers/auditors get 403 on mutations, and listing is filtered.
+ */
+import { describe, it, expect, beforeAll, afterAll, beforeEach, vi } from 'vitest';
+import request from 'supertest';
+import bcrypt from 'bcrypt';
+import { setupTestDb, cleanupTestDb, loginAsTestAdmin } from './helpers/setupTestDb';
+
+let tmpDir: string;
+let app: import('express').Express;
+let DatabaseService: typeof import('../services/DatabaseService').DatabaseService;
+let adminCookie: string;
+let deployerCookie: string;
+let viewerCookie: string;
+let auditorCookie: string;
+let tierSpy: ReturnType<typeof vi.spyOn>;
+
+/**
+ * Creates a user whose ONLY source of the given permission is a scoped
+ * role assignment. The global role is set to 'viewer' so the scoped
+ * grant is the sole path for authorization beyond read-only access.
+ */
+async function createScopedUser(
+  app: import('express').Express,
+  db: ReturnType<typeof DatabaseService.getInstance>,
+  username: string,
+  assignmentRole: 'deployer' | 'node-admin',
+  resourceType: 'stack' | 'node',
+  resourceId: string,
+  nodeId?: number,
+): Promise<string> {
+  const hash = await bcrypt.hash('testpass', 1);
+  const userId = db.addUser({ username, password_hash: hash, role: 'viewer' });
+  db.addRoleAssignment({ user_id: userId, role: assignmentRole, resource_type: resourceType, resource_id: resourceId, node_id: nodeId ?? null });
+  const res = await request(app).post('/api/auth/login').send({ username, password: 'testpass' });
+  const cookies = res.headers['set-cookie'] as string | string[];
+  return Array.isArray(cookies) ? cookies[0] : cookies;
+}
+
+let scopedDeployerCookie: string;
+let scopedNodeAdminCookie: string;
+let secondStackDeployerCookie: string;
+
+beforeAll(async () => {
+  tmpDir = await setupTestDb();
+  ({ DatabaseService } = await import('../services/DatabaseService'));
+  const db = DatabaseService.getInstance();
+
+  const { LicenseService } = await import('../services/LicenseService');
+  tierSpy = vi.spyOn(LicenseService.getInstance(), 'getTier').mockReturnValue('paid');
+
+  ({ app } = await import('../index'));
+  adminCookie = await loginAsTestAdmin(app);
+
+  // Global roles
+  for (const [role, pw] of [['deployer', 'dp'], ['viewer', 'vwp'], ['auditor', 'aud']] as const) {
+    const hash = await bcrypt.hash(pw, 1);
+    db.addUser({ username: `sched-${role}`, password_hash: hash, role });
+    const res = await request(app).post('/api/auth/login').send({ username: `sched-${role}`, password: pw });
+    const cookies = res.headers['set-cookie'] as string | string[];
+    const c = Array.isArray(cookies) ? cookies[0] : cookies;
+    if (role === 'deployer') deployerCookie = c;
+    else if (role === 'viewer') viewerCookie = c;
+    else auditorCookie = c;
+  }
+
+  // Insert a local node for stack-target fixtures
+  for (const [nodeName, nodeType] of [['local-test', 'local'], ['remote-test', 'remote']] as const) {
+    const existing = db.getDb().prepare('SELECT id FROM nodes WHERE name = ?').get(nodeName) as { id: number } | undefined;
+    if (!existing) {
+      db.getDb().prepare(
+        `INSERT INTO nodes (name, type, mode, compose_dir, is_default, status, created_at)
+         VALUES (?, ?, 'proxy', '/tmp/compose', 0, 'online', ?)`,
+      ).run(nodeName, nodeType, Date.now());
+    }
+  }
+
+  // Scoped deployer: stack:deploy on stack "web" at node 1
+  scopedDeployerCookie = await createScopedUser(app, db, 'scoped-deploy', 'deployer', 'stack', 'web', 1);
+  // Scoped node-admin: node:manage on node 1
+  scopedNodeAdminCookie = await createScopedUser(app, db, 'scoped-nodeadm', 'node-admin', 'node', '1');
+  // Second scoped deployer: stack:deploy on stack "api" at node 1
+  secondStackDeployerCookie = await createScopedUser(app, db, 'scoped-deploy-2', 'deployer', 'stack', 'api', 1);
+});
+
+afterAll(() => cleanupTestDb(tmpDir));
+
+beforeEach(() => {
+  const db = DatabaseService.getInstance().getDb();
+  db.prepare('DELETE FROM scheduled_tasks').run();
+  tierSpy.mockReturnValue('paid');
+});
+
+const stackRestartPayload = {
+  name: 'nightly-restart', target_type: 'stack', target_id: 'web',
+  node_id: 1, action: 'restart', cron_expression: '0 3 * * *', enabled: true,
+};
+
+const nodeScanPayload = {
+  name: 'nightly-scan', target_type: 'system', target_id: null,
+  node_id: 1, action: 'scan', cron_expression: '0 4 * * *', enabled: true,
+};
+
+const prunePayload = {
+  name: 'weekly-prune', target_type: 'system', target_id: null,
+  node_id: 1, action: 'prune', cron_expression: '0 5 * * 0', enabled: true,
+};
+
+const fleetUpdatePayload = {
+  name: 'fleet-update', target_type: 'fleet', target_id: null,
+  node_id: 1, action: 'update', cron_expression: '0 6 * * *', enabled: true,
+};
+
+// ── Create ─────────────────────────────────────────────────────────────────
+
+describe('POST /api/scheduled-tasks (RBAC)', () => {
+  it('allows global deployer (stack:deploy) to create stack restart', async () => {
+    const res = await request(app).post('/api/scheduled-tasks').set('Cookie', deployerCookie).send(stackRestartPayload);
+    expect(res.status).toBe(201);
+  });
+
+  it('allows global deployer to create node scan (node:manage)', async () => {
+    // Global deployer has stack:read + stack:deploy only — no node:manage.
+    const res = await request(app).post('/api/scheduled-tasks').set('Cookie', deployerCookie).send(nodeScanPayload);
+    expect(res.status).toBe(403);
+    expect(res.body.code).toBe('PERMISSION_DENIED');
+  });
+
+  it('allows global deployer to create fleet-wide update (node:manage)', async () => {
+    const res = await request(app).post('/api/scheduled-tasks').set('Cookie', deployerCookie).send(fleetUpdatePayload);
+    expect(res.status).toBe(403);
+  });
+
+  it('rejects global deployer creating prune (system:settings)', async () => {
+    const res = await request(app).post('/api/scheduled-tasks').set('Cookie', deployerCookie).send(prunePayload);
+    expect(res.status).toBe(403);
+  });
+
+  it('allows admin to create prune', async () => {
+    const res = await request(app).post('/api/scheduled-tasks').set('Cookie', adminCookie).send(prunePayload);
+    expect(res.status).toBe(201);
+  });
+
+  it('allows scoped deployer on their own stack', async () => {
+    const res = await request(app).post('/api/scheduled-tasks').set('Cookie', scopedDeployerCookie).send(stackRestartPayload);
+    expect(res.status).toBe(201);
+  });
+
+  it('rejects scoped deployer on a different stack', async () => {
+    const res = await request(app).post('/api/scheduled-tasks').set('Cookie', scopedDeployerCookie).send({
+      ...stackRestartPayload, target_id: 'api',
+    });
+    expect(res.status).toBe(403);
+  });
+
+  it('rejects scoped deployer creating node scan', async () => {
+    const res = await request(app).post('/api/scheduled-tasks').set('Cookie', scopedDeployerCookie).send(nodeScanPayload);
+    expect(res.status).toBe(403);
+  });
+
+  it('allows scoped node-admin to create node scan', async () => {
+    const res = await request(app).post('/api/scheduled-tasks').set('Cookie', scopedNodeAdminCookie).send(nodeScanPayload);
+    expect(res.status).toBe(201);
+  });
+
+  it('rejects scoped node-admin creating prune (unscoped, admin-only)', async () => {
+    const res = await request(app).post('/api/scheduled-tasks').set('Cookie', scopedNodeAdminCookie).send(prunePayload);
+    expect(res.status).toBe(403);
+  });
+
+  it('rejects viewer creating any task', async () => {
+    const res = await request(app).post('/api/scheduled-tasks').set('Cookie', viewerCookie).send(stackRestartPayload);
+    expect(res.status).toBe(403);
+  });
+
+  it('rejects auditor creating any task', async () => {
+    const res = await request(app).post('/api/scheduled-tasks').set('Cookie', auditorCookie).send(stackRestartPayload);
+    expect(res.status).toBe(403);
+  });
+
+  it('records creator_user_id from the authenticated user', async () => {
+    const res = await request(app).post('/api/scheduled-tasks').set('Cookie', deployerCookie).send(stackRestartPayload);
+    expect(res.status).toBe(201);
+    const task = DatabaseService.getInstance().getScheduledTask(res.body.id);
+    expect(task).toBeDefined();
+    expect(task!.creator_user_id).not.toBeNull();
+    expect(task!.created_by).toBe('sched-deployer');
+  });
+});
+
+// ── List filtering ─────────────────────────────────────────────────────────
+
+describe('GET /api/scheduled-tasks (RBAC listing filter)', () => {
+  let db: ReturnType<typeof DatabaseService.getInstance>;
+
+  beforeEach(() => {
+    db = DatabaseService.getInstance();
+    // Create a mix of tasks
+    db.createScheduledTask({
+      name: 'web-restart', target_type: 'stack', target_id: 'web', node_id: 1,
+      action: 'restart', cron_expression: '0 3 * * *', enabled: 1,
+      created_by: 'admin', creator_user_id: 1, created_at: 0, updated_at: 0,
+      last_run_at: null, next_run_at: null, last_status: null, last_error: null,
+      prune_targets: null, target_services: null, prune_label_filter: null,
+      selector_type: null, selector_value: null, delete_after_run: 0, run_at: null,
+    });
+    db.createScheduledTask({
+      name: 'api-restart', target_type: 'stack', target_id: 'api', node_id: 1,
+      action: 'restart', cron_expression: '0 4 * * *', enabled: 1,
+      created_by: 'admin', creator_user_id: 1, created_at: 0, updated_at: 0,
+      last_run_at: null, next_run_at: null, last_status: null, last_error: null,
+      prune_targets: null, target_services: null, prune_label_filter: null,
+      selector_type: null, selector_value: null, delete_after_run: 0, run_at: null,
+    });
+    db.createScheduledTask({
+      name: 'node-scan', target_type: 'system', target_id: null, node_id: 1,
+      action: 'scan', cron_expression: '0 5 * * *', enabled: 1,
+      created_by: 'admin', creator_user_id: 1, created_at: 0, updated_at: 0,
+      last_run_at: null, next_run_at: null, last_status: null, last_error: null,
+      prune_targets: null, target_services: null, prune_label_filter: null,
+      selector_type: null, selector_value: null, delete_after_run: 0, run_at: null,
+    });
+  });
+
+  it('admin sees all tasks', async () => {
+    const res = await request(app).get('/api/scheduled-tasks').set('Cookie', adminCookie);
+    expect(res.status).toBe(200);
+    expect(res.body).toHaveLength(3);
+  });
+
+  it('scoped deployer sees only their own stack tasks', async () => {
+    const res = await request(app).get('/api/scheduled-tasks').set('Cookie', scopedDeployerCookie);
+    expect(res.status).toBe(200);
+    expect(res.body).toHaveLength(1);
+    expect(res.body[0].target_id).toBe('web');
+  });
+
+  it('global deployer sees all stack and node tasks but not prune', async () => {
+    // Global deployer: stack:read + stack:deploy. Can see stack tasks but not
+    // scan (node:manage) or prune (system:settings). Fleet update without a
+    // specific node_id is unscoped node:manage — also 403.
+    const res = await request(app).get('/api/scheduled-tasks').set('Cookie', deployerCookie);
+    expect(res.status).toBe(200);
+    // Should see only the two stack restart tasks
+    expect(res.body).toHaveLength(2);
+    expect(res.body.every((t: any) => t.target_type === 'stack')).toBe(true);
+  });
+
+  it('viewer sees empty list', async () => {
+    const res = await request(app).get('/api/scheduled-tasks').set('Cookie', viewerCookie);
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual([]);
+  });
+});
+
+// ── By-id / runs / export ──────────────────────────────────────────────────
+
+describe('GET /:id, /:id/runs, /:id/runs/export (RBAC)', () => {
+  let taskId: number;
+
+  beforeEach(() => {
+    const db = DatabaseService.getInstance();
+    const res = db.getDb().prepare(`
+      INSERT INTO scheduled_tasks (name, target_type, target_id, node_id, action, cron_expression, enabled, created_by, creator_user_id, created_at, updated_at)
+      VALUES ('test-task', 'stack', 'web', 1, 'restart', '0 3 * * *', 1, 'admin', 1, 0, 0)
+    `).run();
+    taskId = res.lastInsertRowid as number;
+  });
+
+  it('scoped deployer can GET /:id for their own stack', async () => {
+    const res = await request(app).get(`/api/scheduled-tasks/${taskId}`).set('Cookie', scopedDeployerCookie);
+    expect(res.status).toBe(200);
+  });
+
+  it('scoped deployer gets 404 for a different stack task', async () => {
+    // Create a task they don't own
+    const db = DatabaseService.getInstance();
+    const other = db.getDb().prepare(`
+      INSERT INTO scheduled_tasks (name, target_type, target_id, node_id, action, cron_expression, enabled, created_by, creator_user_id, created_at, updated_at)
+      VALUES ('api-task', 'stack', 'api', 1, 'restart', '0 4 * * *', 1, 'admin', 1, 0, 0)
+    `).run();
+    const res = await request(app).get(`/api/scheduled-tasks/${other.lastInsertRowid}`).set('Cookie', scopedDeployerCookie);
+    expect(res.status).toBe(404);
+  });
+});
+
+// ── Update (two-phase) ─────────────────────────────────────────────────────
+
+describe('PUT /:id (RBAC two-phase)', () => {
+  let taskId: number;
+
+  beforeEach(() => {
+    const db = DatabaseService.getInstance();
+    const res = db.getDb().prepare(`
+      INSERT INTO scheduled_tasks (name, target_type, target_id, node_id, action, cron_expression, enabled, created_by, creator_user_id, created_at, updated_at)
+      VALUES ('web-task', 'stack', 'web', 1, 'restart', '0 3 * * *', 1, 'admin', 1, 0, 0)
+    `).run();
+    taskId = res.lastInsertRowid as number;
+  });
+
+  it('scoped deployer can update their own stack task', async () => {
+    const res = await request(app).put(`/api/scheduled-tasks/${taskId}`).set('Cookie', scopedDeployerCookie).send({ name: 'renamed' });
+    expect(res.status).toBe(200);
+  });
+
+  it('scoped deployer gets 403 when trying to retarget to a different stack', async () => {
+    const res = await request(app).put(`/api/scheduled-tasks/${taskId}`).set('Cookie', scopedDeployerCookie).send({ target_id: 'api' });
+    expect(res.status).toBe(403);
+    expect(res.body.code).toBe('PERMISSION_DENIED');
+  });
+
+  it('scoped deployer gets 403 when trying to flip restart -> prune', async () => {
+    // prune requires target_type: system, so include it to reach the
+    // permission check rather than hitting structural validation first.
+    const res = await request(app).put(`/api/scheduled-tasks/${taskId}`).set('Cookie', scopedDeployerCookie).send({ action: 'prune', target_type: 'system', target_id: null });
+    expect(res.status).toBe(403);
+  });
+
+  it('second deployer gets 404 editing a task they do not own', async () => {
+    const res = await request(app).put(`/api/scheduled-tasks/${taskId}`).set('Cookie', secondStackDeployerCookie).send({ name: 'stolen' });
+    expect(res.status).toBe(404);
+  });
+});
+
+// ── Toggle / Run-now ───────────────────────────────────────────────────────
+
+describe('PATCH /:id/toggle and POST /:id/run (RBAC)', () => {
+  let taskId: number;
+
+  beforeEach(() => {
+    const db = DatabaseService.getInstance();
+    const res = db.getDb().prepare(`
+      INSERT INTO scheduled_tasks (name, target_type, target_id, node_id, action, cron_expression, enabled, created_by, creator_user_id, created_at, updated_at)
+      VALUES ('web-task', 'stack', 'web', 1, 'restart', '0 3 * * *', 1, 'admin', 1, 0, 0)
+    `).run();
+    taskId = res.lastInsertRowid as number;
+  });
+
+  it('scoped deployer can toggle their stack task', async () => {
+    const res = await request(app).patch(`/api/scheduled-tasks/${taskId}/toggle`).set('Cookie', scopedDeployerCookie);
+    expect(res.status).toBe(200);
+  });
+
+  it('scoped deployer can run-now their stack task', async () => {
+    const res = await request(app).post(`/api/scheduled-tasks/${taskId}/run`).set('Cookie', scopedDeployerCookie);
+    // 409 (already running) is also acceptable; 202 is the success case
+    // 403 means the permission check rejected
+    expect(res.status).not.toBe(403);
+  });
+
+  it('scoped deployer gets 404 on toggle of other stack task', async () => {
+    const res = await request(app).patch(`/api/scheduled-tasks/${taskId}/toggle`).set('Cookie', secondStackDeployerCookie);
+    expect(res.status).toBe(404);
+  });
+
+  it('viewer gets 404 on toggle', async () => {
+    const res = await request(app).patch(`/api/scheduled-tasks/${taskId}/toggle`).set('Cookie', viewerCookie);
+    expect(res.status).toBe(404);
+  });
+});
+
+// ── Execution-time revalidation ────────────────────────────────────────────
+
+describe('Scheduler revalidation', () => {
+  it('rejects a task whose creator was deleted', async () => {
+    // Verify that executeTask auto-disables the task when the creator no longer exists:
+    const { SchedulerService } = await import('../services/SchedulerService');
+    const db = DatabaseService.getInstance();
+
+    // Create a task with a non-existent creator_user_id
+    const res = db.getDb().prepare(`
+      INSERT INTO scheduled_tasks (name, target_type, target_id, node_id, action, cron_expression, enabled, created_by, creator_user_id, created_at, updated_at)
+      VALUES ('orphan-task', 'stack', 'web', 1, 'restart', '0 3 * * *', 1, 'deleted-user', 99999, 0, 0)
+    `).run();
+    const task = db.getScheduledTask(res.lastInsertRowid as number);
+    expect(task).toBeDefined();
+
+    // executeTask catches TaskAuthorizationError internally (auto-disables the
+    // task and records the error), then returns normally rather than re-throwing.
+    await (SchedulerService.getInstance() as any).executeTask(task!, 'scheduler');
+    const updated = db.getScheduledTask(task!.id);
+    expect(updated!.enabled).toBe(0);
+    expect(updated!.last_error).toContain('creator account no longer exists');
+  });
+
+  it('legacy task with NULL creator_user_id executes without revalidation', async () => {
+    const { SchedulerService } = await import('../services/SchedulerService');
+    const db = DatabaseService.getInstance();
+
+    // A legacy task with NULL creator_user_id
+    const res = db.getDb().prepare(`
+      INSERT INTO scheduled_tasks (name, target_type, target_id, node_id, action, cron_expression, enabled, created_by, creator_user_id, created_at, updated_at)
+      VALUES ('legacy-task', 'stack', 'web', 1, 'restart', '0 3 * * *', 1, 'admin', NULL, 0, 0)
+    `).run();
+    const task = db.getScheduledTask(res.lastInsertRowid as number);
+
+    // Should not throw TaskAuthorizationError. Any other error (e.g., Docker
+    // not available) means the revalidation was skipped correctly.
+    let threwAuthError = false;
+    try {
+      await (SchedulerService.getInstance() as any).executeTask(task!, 'scheduler');
+    } catch (e: unknown) {
+      const { TaskAuthorizationError } = await import('../services/SchedulerService');
+      threwAuthError = e instanceof TaskAuthorizationError;
+    }
+    expect(threwAuthError).toBe(false);
+  });
+});
+
+// ── Registry lockstep ──────────────────────────────────────────────────────
+
+describe('Action registry lockstep', () => {
+  it('every BACKEND_SCHEDULED_ACTIONS entry has a valid permission', async () => {
+    const { BACKEND_SCHEDULED_ACTIONS } = await import('../services/scheduledActionRegistry');
+    const { ALL_PERMISSION_ACTIONS } = await import('../middleware/permissions');
+    for (const def of BACKEND_SCHEDULED_ACTIONS) {
+      expect(ALL_PERMISSION_ACTIONS).toContain(def.permission);
+    }
+  });
+
+  it('resolveTaskPermissionScope covers every (action x target_type) pair', async () => {
+    const { BACKEND_SCHEDULED_ACTIONS, resolveTaskPermissionScope } = await import('../services/scheduledActionRegistry');
+    for (const def of BACKEND_SCHEDULED_ACTIONS) {
+      for (const tt of def.targetTypes) {
+        const scope = resolveTaskPermissionScope(def.id, tt, 'test-stack', 1, null);
+        expect(scope.action).toBeDefined();
+        expect(scope.action).not.toBeNull();
+      }
+    }
+  });
+
+  it('prune resolves unscoped regardless of node_id', async () => {
+    const { resolveTaskPermissionScope } = await import('../services/scheduledActionRegistry');
+    const scope = resolveTaskPermissionScope('prune', 'system', null, 1, null);
+    expect(scope.resourceType).toBeUndefined();
+    expect(scope.action).toBe('system:settings');
+  });
+
+  it('snapshot resolves unscoped', async () => {
+    const { resolveTaskPermissionScope } = await import('../services/scheduledActionRegistry');
+    const scope = resolveTaskPermissionScope('snapshot', 'fleet', null, null, null);
+    expect(scope.resourceType).toBeUndefined();
+    expect(scope.action).toBe('node:manage');
+  });
+
+  it('scan resolves node-scoped', async () => {
+    const { resolveTaskPermissionScope } = await import('../services/scheduledActionRegistry');
+    const scope = resolveTaskPermissionScope('scan', 'system', null, 1, null);
+    expect(scope.resourceType).toBe('node');
+    expect(scope.resourceId).toBe('1');
+    expect(scope.action).toBe('node:manage');
+  });
+});

backend/src/__tests__/scheduled-tasks-routes.test.ts

@@ -47,9 +47,11 @@ describe('GET /api/scheduled-tasks', () => {
     expect(res.status).toBe(401);
   });
 
-  it('rejects non-admin users with 403', async () => {
+  it('returns a permission-filtered list for non-admin users (empty for viewers)', async () => {
     const res = await request(app).get('/api/scheduled-tasks').set('Cookie', viewerCookie);
-    expect(res.status).toBe(403);
+    // Viewers have no scheduled-action permission; they see an empty list, not a 403.
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual([]);
   });
 
   it('returns an empty array when no tasks exist', async () => {

backend/src/__tests__/scheduler-service.test.ts

@@ -1867,6 +1867,7 @@ function makeLifecycleTask(action: ScheduledTask['action'], overrides: Partial<S
     cron_expression: '0 2 * * *',
     enabled: 1,
     created_by: 'admin',
+    creator_user_id: null,
     created_at: 0,
     updated_at: 0,
     last_run_at: null,

backend/src/middleware/permissions.ts

@@ -1,11 +1,15 @@
 import type { Request, Response } from 'express';
 import { DatabaseService, type UserRole, type ResourceType } from '../services/DatabaseService';
+import type { LicenseTier } from '../services/license-types';
 import { isDebugEnabled } from '../utils/debug';
 import { sanitizeForLog } from '../utils/safeLog';
 import { effectiveTier } from './tierGates';
 
 // --- Scoped RBAC Permission Engine (paid) ---
 
+/** Permission subject decoupled from Express Request; used by in-process callers like the scheduler. */
+export interface PermissionSubject { username: string; role: UserRole; userId: number; }
+
 export type PermissionAction =
   | 'stack:read' | 'stack:edit' | 'stack:deploy' | 'stack:create' | 'stack:delete'
   | 'node:read' | 'node:manage'
@@ -78,6 +82,59 @@ export function scopedActionsForStack(
   return [...actions];
 }
 
+/**
+ * Core permission resolver without a Request dependency. Admin bypasses
+ * all checks; scoped assignments only apply on the paid tier. Used by
+ * in-process callers (e.g. the scheduler) that have a subject + tier but
+ * no HTTP context. Does NOT handle scopedStackEvidence (machine-auth hop
+ * elevation) — that path requires a Request.
+ */
+export function checkPermissionForSubject(
+  subject: PermissionSubject,
+  tier: LicenseTier,
+  action: PermissionAction,
+  resourceType?: ResourceType,
+  resourceId?: string,
+  resourceNodeId?: number | null,
+): boolean {
+  if (isDebugEnabled()) console.log('[RBAC:diag] checkPermissionForSubject:', sanitizeForLog(action), 'user:', sanitizeForLog(subject.username), 'globalRole:', sanitizeForLog(subject.role), 'resource:', sanitizeForLog(resourceType), sanitizeForLog(resourceId));
+
+  if (subject.role === 'admin') return true;
+  if (ROLE_PERMISSIONS[subject.role]?.includes(action)) return true;
+
+  if (!resourceType || !resourceId) return false;
+
+  if (tier !== 'paid') return false;
+
+  const db = DatabaseService.getInstance();
+  const nodeId = resourceType === 'stack' ? (resourceNodeId ?? undefined) : null;
+  const assignments = db.getRoleAssignments(
+    subject.userId,
+    resourceType,
+    resourceId,
+    nodeId as number | undefined,
+  );
+  if (isDebugEnabled()) console.log('[RBAC:diag] Scoped assignments found:', assignments.length, 'for user:', subject.userId);
+  for (const assignment of assignments) {
+    if (ROLE_PERMISSIONS[assignment.role]?.includes(action)) return true;
+  }
+
+  // Node-scoped grants are node-wide: a Node Admin / Deployer / Admin on
+  // node N authorizes that role's stack actions for every stack on N.
+  if (resourceType === 'stack' && nodeId != null) {
+    const nodeAssignments = db.getRoleAssignments(
+      subject.userId,
+      'node',
+      String(nodeId),
+    );
+    for (const assignment of nodeAssignments) {
+      if (ROLE_PERMISSIONS[assignment.role]?.includes(action)) return true;
+    }
+  }
+
+  return false;
+}
+
 /** Core permission resolver. Admin bypasses all checks; scoped assignments only apply on the paid tier. */
 export function checkPermission(
   req: Request,

backend/src/routes/scheduledTasks.ts

@@ -7,12 +7,13 @@ import {
   INVALID_ACTION_MESSAGE,
   validateActionTarget,
   getScheduledActionDefinition,
+  resolveTaskPermissionScope,
   type TargetType,
   type BackendScheduledAction,
 } from '../services/scheduledActionRegistry';
 import { SchedulerService } from '../services/SchedulerService';
 import { NotificationService } from '../services/NotificationService';
-import { requireAdmin } from '../middleware/tierGates';
+import { checkPermission, requirePermission } from '../middleware/permissions';
 import { escapeCsvField } from '../utils/csv';
 import { getErrorMessage } from '../utils/errors';
 import { parseIntParam } from '../utils/parseIntParam';
@@ -252,14 +253,71 @@ function validateRunAt(runAt: unknown): string | null {
   return null;
 }
 
+/**
+ * Check whether the authenticated user can manage (create, edit, run, delete)
+ * the given task. Consumes the centralized permission scope resolver so the
+ * registry remains the single source of truth for action→permission mapping.
+ */
+function checkTaskPermission(
+  req: Request,
+  task: Pick<ScheduledTask, 'action' | 'target_type' | 'target_id' | 'node_id' | 'selector_type'>,
+): boolean {
+  const scope = resolveTaskPermissionScope(
+    task.action as BackendScheduledAction,
+    task.target_type as TargetType,
+    task.target_id,
+    task.node_id,
+    task.selector_type,
+  );
+  return checkPermission(req, scope.action, scope.resourceType, scope.resourceId, scope.resourceNodeId);
+}
+
+/**
+ * Require permission for a task. Sends 403 if denied; callers must `return;` on false.
+ */
+function requireTaskPermission(
+  req: Request,
+  res: Response,
+  task: Pick<ScheduledTask, 'action' | 'target_type' | 'target_id' | 'node_id' | 'selector_type'>,
+): boolean {
+  const scope = resolveTaskPermissionScope(
+    task.action as BackendScheduledAction,
+    task.target_type as TargetType,
+    task.target_id,
+    task.node_id,
+    task.selector_type,
+  );
+  return requirePermission(req, res, scope.action, scope.resourceType, scope.resourceId, scope.resourceNodeId);
+}
+
+/**
+ * Require permission to access an existing task. Returns 404 (not 403) when
+ * denied, so an unauthorized caller cannot distinguish "task does not exist"
+ * from "task exists but you are not authorized." Used on by-ID endpoints
+ * where the task's existence has already been confirmed.
+ */
+function requireTaskExistsPermission(
+  req: Request,
+  res: Response,
+  task: Pick<ScheduledTask, 'action' | 'target_type' | 'target_id' | 'node_id' | 'selector_type'>,
+): boolean {
+  if (checkTaskPermission(req, task)) return true;
+  res.status(404).json({ error: 'Scheduled task not found' });
+  return false;
+}
+
 export const scheduledTasksRouter = Router();
 
 scheduledTasksRouter.get('/', (req: Request, res: Response): void => {
-  if (!requireAdmin(req, res)) return;
   try {
     let tasks = DatabaseService.getInstance().getScheduledTasks();
-    // The Scheduled Operations view manages every task type, so it lists all of
-    // them. `action` / `exclude_action` exist for the read-only consumers that
+
+    // Permission-filter the full list so a scoped deployer sees only tasks
+    // targeting their authorized resources. Admin sees every task (checkTaskPermission
+    // always returns true for admin via checkPermission's admin bypass).
+    tasks = tasks.filter(t => checkTaskPermission(req, t));
+
+    // `action` / `exclude_action` exist for the read-only consumers that
     // want a slice: the Auto-Update readiness card and the sidebar next-run
     // indicator both request `?action=update`.
     const actionFilter = typeof req.query.action === 'string' ? req.query.action : undefined;
@@ -288,7 +346,6 @@ scheduledTasksRouter.get('/', (req: Request, res: Response): void => {
 });
 
 scheduledTasksRouter.post('/', (req: Request, res: Response): void => {
-  if (!requireAdmin(req, res)) return;
   try {
     const {
       name, target_type, target_id, node_id, action, cron_expression, enabled,
@@ -327,19 +384,6 @@ scheduledTasksRouter.post('/', (req: Request, res: Response): void => {
     const runAtErr = validateRunAt(run_at);
     if (runAtErr) { res.status(400).json({ error: runAtErr }); return; }
 
-    const scheduler = SchedulerService.getInstance();
-    const now = Date.now();
-    // Persist the one-shot's pinned instant in its own column so it survives a
-    // disabled state and edit (the yearless cron cannot reconstruct the year).
-    // next_run_at is the cron-derived run unless a run_at pins it, and is null
-    // while disabled; the pinned run_at is retained regardless so enabling later
-    // restores the exact instant.
-    const pinnedRunAt = typeof run_at === 'number' ? run_at : null;
-    const nextRun = (enabled === false)
-      ? null
-      : (pinnedRunAt ?? scheduler.calculateNextRun(cron_expression));
-    const normalizedTargetId =
-      target_type === 'stack' || target_type === 'container' ? target_id : null;
     const labelSelector = usesStackLabelSelector(action, target_type, selector_type);
     const normalizedNodeId = labelSelector
       ? (node_id == null || node_id === '' ? null : parsePositiveNodeId(node_id))
@@ -347,6 +391,24 @@ scheduledTasksRouter.post('/', (req: Request, res: Response): void => {
     if (labelSelector && node_id != null && node_id !== '' && normalizedNodeId === null) {
       res.status(400).json({ error: 'Fleet update action requires a valid node_id.' }); return;
     }
+    const normalizedTargetId =
+      target_type === 'stack' || target_type === 'container' ? target_id : null;
+
+    // Permission check on the resolved action+target scope.
+    if (!requireTaskPermission(req, res, {
+      action,
+      target_type,
+      target_id: normalizedTargetId,
+      node_id: normalizedNodeId,
+      selector_type: labelSelector ? STACK_LABEL_SELECTOR : null,
+    })) return;
+
+    const scheduler = SchedulerService.getInstance();
+    const now = Date.now();
+    const pinnedRunAt = typeof run_at === 'number' ? run_at : null;
+    const nextRun = (enabled === false)
+      ? null
+      : (pinnedRunAt ?? scheduler.calculateNextRun(cron_expression));
     const selectors = normalizeSelectorFields(action, target_type, selector_type, selector_value);
 
     const id = DatabaseService.getInstance().createScheduledTask({
@@ -358,6 +420,7 @@ scheduledTasksRouter.post('/', (req: Request, res: Response): void => {
       cron_expression,
       enabled: enabled !== false ? 1 : 0,
       created_by: req.user?.username || 'admin',
+      creator_user_id: req.user?.userId ?? null,
       created_at: now,
       updated_at: now,
       last_run_at: null,
@@ -384,12 +447,12 @@ scheduledTasksRouter.post('/', (req: Request, res: Response): void => {
 });
 
 scheduledTasksRouter.get('/:id', (req: Request, res: Response): void => {
-  if (!requireAdmin(req, res)) return;
   try {
     const id = parseIntParam(req, res, 'id', 'task ID');
     if (id === null) return;
     const task = DatabaseService.getInstance().getScheduledTask(id);
     if (!task) { res.status(404).json({ error: 'Scheduled task not found' }); return; }
+    if (!requireTaskExistsPermission(req, res, task)) return;
     res.json(task);
   } catch (error) {
     console.error('[ScheduledTasks] Get error:', error);
@@ -398,7 +461,6 @@ scheduledTasksRouter.get('/:id', (req: Request, res: Response): void => {
 });
 
 scheduledTasksRouter.put('/:id', (req: Request, res: Response): void => {
-  if (!requireAdmin(req, res)) return;
   try {
     const id = parseIntParam(req, res, 'id', 'task ID');
     if (id === null) return;
@@ -407,6 +469,14 @@ scheduledTasksRouter.put('/:id', (req: Request, res: Response): void => {
     const existing = db.getScheduledTask(id);
     if (!existing) { res.status(404).json({ error: 'Scheduled task not found' }); return; }
 
+    // Two-phase check: (1) the caller must be authorized for the existing task
+    // (prevents task take-over; returns 404 so task ID existence is not
+    // disclosed), and (2) the merged target must also be authorized (prevents
+    // retargeting escalation, like flipping restart→prune; returns 403 since
+    // this is a permission denial on the requested change, not an ownership
+    // check).
+    if (!requireTaskExistsPermission(req, res, existing)) return;
+
     const {
       name, target_type, target_id, node_id, action, cron_expression, enabled,
       prune_targets, target_services, prune_label_filter, selector_type, selector_value,
@@ -529,6 +599,15 @@ scheduledTasksRouter.put('/:id', (req: Request, res: Response): void => {
       updates.next_run_at = null;
     }
 
+    // Second phase: the caller must have permission for the merged scope.
+    if (!requireTaskPermission(req, res, {
+      action: finalAction,
+      target_type: finalTargetType,
+      target_id: finalTargetId,
+      node_id: finalNodeId != null ? parsePositiveNodeId(finalNodeId) : null,
+      selector_type: finalSelectorType,
+    })) return;
+
     db.updateScheduledTask(id, updates);
     console.log(`[ScheduledTasks] Updated task id=${id}`);
     const task = db.getScheduledTask(id);
@@ -541,7 +620,6 @@ scheduledTasksRouter.put('/:id', (req: Request, res: Response): void => {
 });
 
 scheduledTasksRouter.delete('/:id', (req: Request, res: Response): void => {
-  if (!requireAdmin(req, res)) return;
   try {
     const id = parseIntParam(req, res, 'id', 'task ID');
     if (id === null) return;
@@ -549,6 +627,7 @@ scheduledTasksRouter.delete('/:id', (req: Request, res: Response): void => {
     const db = DatabaseService.getInstance();
     const existing = db.getScheduledTask(id);
     if (!existing) { res.status(404).json({ error: 'Scheduled task not found' }); return; }
+    if (!requireTaskExistsPermission(req, res, existing)) return;
 
     db.deleteScheduledTask(id);
     console.log(`[ScheduledTasks] Deleted task id=${id}`);
@@ -561,7 +640,6 @@ scheduledTasksRouter.delete('/:id', (req: Request, res: Response): void => {
 });
 
 scheduledTasksRouter.patch('/:id/toggle', (req: Request, res: Response): void => {
-  if (!requireAdmin(req, res)) return;
   try {
     const id = parseIntParam(req, res, 'id', 'task ID');
     if (id === null) return;
@@ -569,6 +647,7 @@ scheduledTasksRouter.patch('/:id/toggle', (req: Request, res: Response): void =>
     const db = DatabaseService.getInstance();
     const existing = db.getScheduledTask(id);
     if (!existing) { res.status(404).json({ error: 'Scheduled task not found' }); return; }
+    if (!requireTaskExistsPermission(req, res, existing)) return;
 
     const newEnabled = existing.enabled ? 0 : 1;
     // On enable, a one-shot's persisted run_at restores the exact pinned instant
@@ -596,7 +675,6 @@ scheduledTasksRouter.patch('/:id/toggle', (req: Request, res: Response): void =>
 });
 
 scheduledTasksRouter.post('/:id/run', (req: Request, res: Response): void => {
-  if (!requireAdmin(req, res)) return;
   try {
     const id = parseIntParam(req, res, 'id', 'task ID');
     if (id === null) return;
@@ -604,6 +682,7 @@ scheduledTasksRouter.post('/:id/run', (req: Request, res: Response): void => {
     const db = DatabaseService.getInstance();
     const existing = db.getScheduledTask(id);
     if (!existing) { res.status(404).json({ error: 'Scheduled task not found' }); return; }
+    if (!requireTaskExistsPermission(req, res, existing)) return;
 
     const scheduler = SchedulerService.getInstance();
     if (scheduler.isTaskRunning(id)) {
@@ -625,7 +704,6 @@ scheduledTasksRouter.post('/:id/run', (req: Request, res: Response): void => {
 });
 
 scheduledTasksRouter.get('/:id/runs/export', (req: Request, res: Response): void => {
-  if (!requireAdmin(req, res)) return;
   try {
     const id = parseIntParam(req, res, 'id', 'task ID');
     if (id === null) return;
@@ -633,6 +711,7 @@ scheduledTasksRouter.get('/:id/runs/export', (req: Request, res: Response): void
     const db = DatabaseService.getInstance();
     const task = db.getScheduledTask(id);
     if (!task) { res.status(404).json({ error: 'Scheduled task not found' }); return; }
+    if (!requireTaskExistsPermission(req, res, task)) return;
 
     const runs = db.getAllScheduledTaskRuns(id);
 
@@ -659,7 +738,6 @@ scheduledTasksRouter.get('/:id/runs/export', (req: Request, res: Response): void
 });
 
 scheduledTasksRouter.get('/:id/runs', (req: Request, res: Response): void => {
-  if (!requireAdmin(req, res)) return;
   try {
     const id = parseIntParam(req, res, 'id', 'task ID');
     if (id === null) return;
@@ -667,6 +745,7 @@ scheduledTasksRouter.get('/:id/runs', (req: Request, res: Response): void => {
     const db = DatabaseService.getInstance();
     const existing = db.getScheduledTask(id);
     if (!existing) { res.status(404).json({ error: 'Scheduled task not found' }); return; }
+    if (!requireTaskExistsPermission(req, res, existing)) return;
 
     const limit = Math.min(parseInt(req.query.limit as string, 10) || 20, 100);
     const offset = Math.max(parseInt(req.query.offset as string, 10) || 0, 0);

backend/src/services/DatabaseService.ts

@@ -707,6 +707,8 @@ export interface ScheduledTask {
     cron_expression: string;
     enabled: number;
     created_by: string;
+    /** The user ID who created this schedule. Null for legacy rows (pre-RBAC) where username resolution failed at migration time. */
+    creator_user_id: number | null;
     created_at: number;
     updated_at: number;
     last_run_at: number | null;
@@ -1946,6 +1948,18 @@ export class DatabaseService {
         maybeAddCol('scheduled_tasks', 'selector_value', 'TEXT DEFAULT NULL');
         maybeAddCol('scheduled_tasks', 'delete_after_run', 'INTEGER DEFAULT 0');
         maybeAddCol('scheduled_tasks', 'run_at', 'INTEGER DEFAULT NULL');
+        maybeAddCol('scheduled_tasks', 'creator_user_id', 'INTEGER DEFAULT NULL');
+
+        // Backfill creator_user_id from the created_by username column.
+        // Rows whose username no longer matches a user stay NULL (legacy,
+        // unrevalidated path — they were created under the old requireAdmin gate).
+        this.db.exec(`
+          UPDATE scheduled_tasks
+          SET creator_user_id = (
+            SELECT id FROM users WHERE username = scheduled_tasks.created_by
+          )
+          WHERE creator_user_id IS NULL
+        `);
 
         // Recreate stack_update_status with composite PK (node_id, stack_name).
         // Original table had stack_name as sole PK which breaks when multiple nodes share stack names.
@@ -6185,12 +6199,13 @@ export class DatabaseService {
         return this.db.prepare('SELECT * FROM scheduled_tasks WHERE id = ?').get(id) as ScheduledTask | undefined;
     }
 
-    public createScheduledTask(task: Omit<ScheduledTask, 'id'>): number {
+    public createScheduledTask(task: Omit<ScheduledTask, 'id' | 'creator_user_id'> & { creator_user_id?: number | null }): number {
         const result = this.db.prepare(
-            'INSERT INTO scheduled_tasks (name, target_type, target_id, node_id, action, cron_expression, enabled, created_by, created_at, updated_at, last_run_at, next_run_at, last_status, last_error, prune_targets, target_services, prune_label_filter, selector_type, selector_value, delete_after_run, run_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)'
+            'INSERT INTO scheduled_tasks (name, target_type, target_id, node_id, action, cron_expression, enabled, created_by, creator_user_id, created_at, updated_at, last_run_at, next_run_at, last_status, last_error, prune_targets, target_services, prune_label_filter, selector_type, selector_value, delete_after_run, run_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)'
         ).run(
             task.name, task.target_type, task.target_id, task.node_id,
             task.action, task.cron_expression, task.enabled, task.created_by,
+            task.creator_user_id ?? null,
             task.created_at, task.updated_at, task.last_run_at, task.next_run_at,
             task.last_status, task.last_error, task.prune_targets, task.target_services,
             task.prune_label_filter, task.selector_type ?? null, task.selector_value ?? null,

backend/src/services/SchedulerService.ts

@@ -2,6 +2,7 @@ import { CronExpressionParser } from 'cron-parser';
 import { DatabaseService } from './DatabaseService';
 import type { ScheduledTask } from './DatabaseService';
 import { LicenseService } from './LicenseService';
+import type { LicenseTier } from './license-types';
 import { PROXY_TIER_HEADER, deployProvenanceHeaders } from './license-headers';
 import DockerController from './DockerController';
 import { ComposeService } from './ComposeService';
@@ -35,6 +36,8 @@ import { filterContainersByComposeService } from '../helpers/composeServiceMatch
 import { excludeSelfContainers } from '../helpers/excludeSelfContainers';
 import { enforcePolicyPreDeploy } from './PolicyEnforcement';
 import { summarizeBlockReasons } from '../utils/policy-risk';
+import { resolveTaskPermissionScope, type BackendScheduledAction, type TargetType } from './scheduledActionRegistry';
+import { checkPermissionForSubject } from '../middleware/permissions';
 
 const TRIVY_UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
 const TRIVY_UPDATE_CHECK_STARTUP_DELAY_MS = 5 * 60 * 1000;
@@ -42,6 +45,14 @@ const TRIVY_UPDATE_CHECK_STARTUP_DELAY_MS = 5 * 60 * 1000;
 const TRIVY_REDETECT_INTERVAL_MS = 10 * 60 * 1000;
 const STALE_SCAN_THRESHOLD_MS = 15 * 60 * 1000;
 
+/** Thrown when a scheduled task's creator no longer has permission for the target action. */
+export class TaskAuthorizationError extends Error {
+    constructor(message: string) {
+        super(message);
+        this.name = 'TaskAuthorizationError';
+    }
+}
+
 export class SchedulerService {
     private static instance: SchedulerService;
     private intervalId: ReturnType<typeof setInterval> | null = null;
@@ -303,6 +314,38 @@ export class SchedulerService {
         });
 
         try {
+            // Permission revalidation: for automatic runs, verify the creator still holds
+            // the required permission. Runs before the node-reachability check so that
+            // a revoked authorization is surfaced even when the target node is offline
+            // — a misleading "target node is offline" error must not hide the real
+            // reason the task cannot execute. Manual runs skip this; the route's
+            // acting-user check is the gate. Legacy tasks (creator_user_id NULL)
+            // execute as before.
+            if (triggeredBy === 'scheduler' && task.creator_user_id != null) {
+                const creator = db.getUserById(task.creator_user_id);
+                if (!creator) {
+                    throw new TaskAuthorizationError('Scheduled task no longer authorized: creator account no longer exists.');
+                }
+                const scope = resolveTaskPermissionScope(
+                    task.action as BackendScheduledAction,
+                    task.target_type as TargetType,
+                    task.target_id,
+                    task.node_id,
+                    task.selector_type,
+                );
+                const tier: LicenseTier = LicenseService.getInstance().getTier();
+                if (!checkPermissionForSubject(
+                    { username: creator.username, role: creator.role, userId: creator.id },
+                    tier,
+                    scope.action,
+                    scope.resourceType,
+                    scope.resourceId,
+                    scope.resourceNodeId,
+                )) {
+                    throw new TaskAuthorizationError('Scheduled task no longer authorized: creator permission was revoked.');
+                }
+            }
+
             // Pre-check: ensure target node exists and is reachable
             if (task.node_id != null && task.action !== 'snapshot') {
                 const node = db.getNode(task.node_id);
@@ -426,6 +469,10 @@ export class SchedulerService {
                 updates.enabled = 0;
                 console.warn(`[SchedulerService] Task "${task.name}" (id=${task.id}) auto-disabled: cron expression invalid`);
             }
+            if (error instanceof TaskAuthorizationError) {
+                updates.enabled = 0;
+                console.warn(`[SchedulerService] Task "${task.name}" (id=${task.id}) auto-disabled: creator authorization revoked`);
+            }
             db.updateScheduledTask(task.id, updates);
             db.updateScheduledTaskRun(runId, {
                 completed_at: Date.now(),

backend/src/services/scheduledActionRegistry.ts

@@ -1,8 +1,9 @@
 /**
  * Single source of truth for scheduled-operation action metadata that the
- * backend needs for validation. The route layer derives its allow-list and
- * action/target compatibility checks from this table, so adding a new action
- * means adding one entry here (plus its execution logic in SchedulerService).
+ * backend needs for validation and authorization. The route layer derives its
+ * allow-list, action/target compatibility checks, and permission enforcement
+ * from this table, so adding a new action means adding one entry here
+ * (plus its execution logic in SchedulerService).
  *
  * The frontend keeps its own richer registry (labels, categories, tones) in
  * `frontend/src/lib/scheduledActions.ts`; the two cannot share a module because
@@ -10,6 +11,9 @@
  * each side.
  */
 
+import type { PermissionAction } from '../middleware/permissions';
+import type { ResourceType } from './DatabaseService';
+
 export const VALID_TARGET_TYPES = ['stack', 'fleet', 'system', 'container'] as const;
 export type TargetType = typeof VALID_TARGET_TYPES[number];
 
@@ -19,6 +23,19 @@ export interface BackendScheduledActionDefinition {
   readonly targetTypes: readonly TargetType[];
   readonly requiresNode: boolean;
   readonly nodeScope?: 'local';
+  /** Permission required to create, edit, enable, run, or delete a schedule for this action. */
+  readonly permission: PermissionAction;
+}
+
+/**
+ * Permission scope resolved from a task's action, target, and node identity.
+ * When `resourceType` is omitted the check is unscoped (global role matrix only).
+ */
+export interface ScheduledActionPermissionScope {
+  readonly action: PermissionAction;
+  readonly resourceType?: ResourceType;
+  readonly resourceId?: string;
+  readonly resourceNodeId?: number | null;
 }
 
 /**
@@ -26,15 +43,15 @@ export interface BackendScheduledActionDefinition {
  * in `routes/scheduledTasks.ts` ("Must be restart, snapshot, prune, ...").
  */
 export const BACKEND_SCHEDULED_ACTIONS = [
-  { id: 'restart', targetTypes: ['stack', 'container'], requiresNode: true },
-  { id: 'snapshot', targetTypes: ['fleet'], requiresNode: false },
-  { id: 'prune', targetTypes: ['system'], requiresNode: true, nodeScope: 'local' },
-  { id: 'update', targetTypes: ['stack', 'fleet'], requiresNode: true },
-  { id: 'scan', targetTypes: ['system'], requiresNode: true, nodeScope: 'local' },
-  { id: 'auto_backup', targetTypes: ['stack'], requiresNode: true },
-  { id: 'auto_stop', targetTypes: ['stack', 'container'], requiresNode: true },
-  { id: 'auto_down', targetTypes: ['stack'], requiresNode: true },
-  { id: 'auto_start', targetTypes: ['stack', 'container'], requiresNode: true },
+  { id: 'restart',    targetTypes: ['stack', 'container'], requiresNode: true,  permission: 'stack:deploy' as const },
+  { id: 'snapshot',   targetTypes: ['fleet'],              requiresNode: false, permission: 'node:manage' as const },
+  { id: 'prune',      targetTypes: ['system'],             requiresNode: true,  nodeScope: 'local' as const, permission: 'system:settings' as const },
+  { id: 'update',     targetTypes: ['stack', 'fleet'],     requiresNode: true,  permission: 'stack:deploy' as const },
+  { id: 'scan',       targetTypes: ['system'],             requiresNode: true,  nodeScope: 'local' as const, permission: 'node:manage' as const },
+  { id: 'auto_backup',targetTypes: ['stack'],              requiresNode: true,  permission: 'stack:deploy' as const },
+  { id: 'auto_stop',  targetTypes: ['stack', 'container'], requiresNode: true,  permission: 'stack:deploy' as const },
+  { id: 'auto_down',  targetTypes: ['stack'],              requiresNode: true,  permission: 'stack:deploy' as const },
+  { id: 'auto_start', targetTypes: ['stack', 'container'], requiresNode: true,  permission: 'stack:deploy' as const },
 ] as const satisfies readonly BackendScheduledActionDefinition[];
 
 export type BackendScheduledAction = typeof BACKEND_SCHEDULED_ACTIONS[number]['id'];
@@ -83,3 +100,58 @@ export function validateActionTarget(action: BackendScheduledAction, targetType:
 export function getScheduledActionDefinition(action: BackendScheduledAction): BackendScheduledActionDefinition | undefined {
   return ACTION_BY_ID.get(action);
 }
+
+/**
+ * Resolve the permission scope for a scheduled action + target combination.
+ * This is the single source of truth consumed by the route layer and the
+ * scheduler revalidation path. Scope resolution is per-action, not per
+ * target-type bucket.
+ */
+export function resolveTaskPermissionScope(
+  action: BackendScheduledAction,
+  targetType: TargetType,
+  targetId: string | null,
+  nodeId: number | null,
+  _selectorType?: string | null,
+): ScheduledActionPermissionScope {
+  const def = ACTION_BY_ID.get(action);
+  const basePermission = def?.permission ?? 'stack:deploy';
+
+  switch (action) {
+    case 'restart':
+    case 'auto_stop':
+    case 'auto_start': {
+      if (targetType === 'container') {
+        return { action: 'node:manage', resourceType: 'node', resourceId: nodeId != null ? String(nodeId) : undefined, resourceNodeId: nodeId };
+      }
+      return { action: basePermission, resourceType: 'stack', resourceId: targetId ?? undefined, resourceNodeId: nodeId };
+    }
+    case 'auto_down':
+    case 'auto_backup':
+      return { action: basePermission, resourceType: 'stack', resourceId: targetId ?? undefined, resourceNodeId: nodeId };
+
+    case 'update': {
+      if (targetType === 'stack') {
+        return { action: basePermission, resourceType: 'stack', resourceId: targetId ?? undefined, resourceNodeId: nodeId };
+      }
+      if (nodeId != null) {
+        return { action: 'node:manage', resourceType: 'node', resourceId: String(nodeId), resourceNodeId: nodeId };
+      }
+      return { action: 'node:manage' };
+    }
+
+    case 'scan':
+      return { action: basePermission, resourceType: 'node', resourceId: nodeId != null ? String(nodeId) : undefined, resourceNodeId: nodeId };
+
+    case 'prune':
+      return { action: basePermission };
+
+    case 'snapshot':
+      return { action: basePermission };
+
+    default: {
+      const exhaustive: never = action;
+      return { action: exhaustive as never };
+    }
+  }
+}