- Shipped
- August 15, 2026 at 1:50 AM UTC
- Author
- kamo
- Commit
- 9a5b516
Fifth cluster. The Notes backend is KBService, not SecurityService: the entity sits under donotmodify/dao/beans/security/ and kamo-internal proxies /api/notes/* through forwardToApi, which names no service, so it takes a search to find each time. NotesController gated nothing on any of its ten endpoints. VIEW_NOTES was a client-only gate in navRegistry.ts, so the browser hid the app and the API served it anyway; the CRUD rights gated nothing anywhere. All ten now take the right that names them, with no seeding — no member holds VIEW_NOTES without the write rights, only three notes exist and both owners hold all four, so nothing is lost. SHARE_NOTES and MANAGE_NOTES_SETTINGS stay on the list for now with the evidence recorded: notes have no sharing modelled anywhere — no column, no DTO field, no table, no endpoint, no UI, and a per-owner content key that makes sharing a re-keying problem — and there is no notes settings surface of any kind. Both are the chat-channel case rather than the coarse-gated one, so they should be deleted rather than implemented. Not done here: deleting an enum value reaches shared-lib and burns an id permanently, and that is not a change to rush. Also records that SessionHelper.hasRight in KBService was failing open, which made the knowledge-base rights this document calls "fully enforced (7/7)" enforced only for callers who happened to carry a populated rights list.