- Shipped
- August 15, 2026 at 2:59 AM UTC
- Author
- kamo
- Commit
- 29b319f
CREATE, EDIT, DELETE_DOCUMENTS and MANAGE_STORAGE now gate DocsService's ImagingController and DocumentController and ConversionService's upload endpoints. The last of those is the part that made this a four-service cluster rather than a one-controller change: the upload path is not in DocsService at all, so gating only DocsService would have shipped a CREATE_DOCUMENTS enforced on folders and bypassed by uploading a file. Not seeded. DELETE_DOCUMENTS and MANAGE_STORAGE are Administrator-only in all 14 orgs, so 14 members lose document deletion — the configuration taking effect rather than an accident. The rule this settles, and the one to carry into the clusters still open: a right that is differentially granted carries intent and must not be seeded; a right nobody holds at all, as with START_MEETING, carries none and must be. The design document now records the four judgement calls — why /open takes EDIT_DOCUMENTS rather than VIEW_DOCUMENTS, why backfill-thumbnails takes MANAGE_STORAGE, why the shares sub-API is left to the SHARE_DOCS_* rights, and why check-hashes and register-existing count as creation — along with the two test fixtures that had to start granting and the pre-existing ConversionService image test failure that is not ours.