Bug: Non-members able to access paid certification modules (A3+)

[geneticallymodifiedfoodforthought]

Problem

Non-members (users without an active AAO membership) are able to access and progress through paid certification modules (A3 and above). These modules should be gated behind membership.

Confirmed case

• Escalation Add unified contacts view with engagement scoring #462 — John Castillo (gmail.com, no AAO membership) reached A3 and reported issues mid-module. A3 requires a paid membership tier to access.

Expected behavior

Non-members should hit a paywall at the A3 module boundary. The system should prompt them to purchase membership before proceeding.

Actual behavior

Non-members can start and progress through A3 without being blocked.

Impact

• Revenue leak — members paying for certification access are subsidizing free access for non-members
• Likely affects all paid modules (A3+)

Steps to reproduce

1. Create a free/personal account (gmail.com)
2. Complete A1 and A2 (free modules)
3. Attempt to start A3
4. Observe: no paywall, module starts normally

Related

• Escalation Add unified contacts view with engagement scoring #462 (John Castillo)

[bokelley]

Triage

Classification: Bug
Bucket(s): training / certification, addie, security-sensitive
Status: ready-for-human

What the experts said:

• security-reviewer: Confirmed; membership enforcement is absent at module completion — the more critical gap, because non-members who reach A3 in-progress by any path can earn externally-verifiable Certifier credentials with no re-check at that step. Bypass vectors withheld from this public comment. P0 for credential integrity, P1 for module access.
• education-expert: Completion gate entirely missing from complete_certification_module; separately, certification-tools.ts line 1683 hardcodes A3 as free-for-everyone, which may conflict with the DB is_free field — that ambiguity must be resolved before any fix deploys. Credential records contain no membership-status field, so affected badges are indistinguishable from legitimate ones and cannot be identified without a data audit.

My take: Both experts converge: the credential-issuance gap (no membership check at completion) outweighs the revenue leak — Certifier badges issued to non-members are publicly verifiable and currently irrevocable, with no remediation policy covering this scenario. Two human decisions required before implementation: (1) confirm A3's intended paid/free status against the DB is_free value vs. the hardcoded string, and (2) @bokelley: call on whether credentials already issued under this gap are grandfathered, annotated, or revoked — no policy in docs/learning/policies/ currently covers access-violation remediation.

Fix scope (no bypass-path detail):

• Reconcile A3 is_free DB value with certification-tools.ts line 1683 — policy must be unambiguous before code ships
• Add membership re-check to complete_certification_module before certDb.completeModule() is called (currently absent for paid modules)
• Add membership re-check to checkpoint_teaching_progress as defense-in-depth
• Audit learner_progress for non-member completions of paid modules; inventory affected user_credentials rows and associated Certifier badge IDs
• Add remediation-policy section to docs/learning/policies/recertification.mdx

Related: #6053 (same Escalation #462, blank A3 resumption after context limit) — the access gap explains how that user reached A3 to begin with.

---

Triaged by Claude Code. Session: https://claude.ai/code/${CLAUDE_CODE_REMOTE_SESSION_ID}

---

Generated by Claude Code