- Shipped
- August 28, 2026 at 12:48 AM UTC
- Author
- Kamo
- Commit
- 60aefad
Ten new rights, 278-287: NOTES_MASTER_MINE_WIDGET and NOTES_MASTER_OURS_WIDGET, each with the four policy children every home widget carries. Both hang off VIEW_NOTES — the right that gates the DATA — because a widget parented anywhere else is a way round the gate on what it displays. MANAGE_ORG_MASTER_NOTE (228) moves from a standalone root with no ServiceType to a child of VIEW_NOTES tagged NOTES. Its old comment argued that the organisation master note was a launchpad fixture KBService served without any notes right, so tagging it NOTES would hide the right from orgs that could still see the note. That premise is gone: GET /api/notes/master now takes VIEW_NOTES like every other read in NotesController. The rest is the same correction applied to three apps that had been filed under their parent, or under nothing at all. The permission editors used to render one flat section per top-level app, so a right tagged with a CHILD app could not be granted anywhere — which is why Service Work's five rights carried POS and why the nine calculator modes carried no ServiceType and sat in the General drawer with forty unrelated rights. The editors render the app TREE now, so: - the nine CALC_* modes take ServiceType.CALCULATOR - the twenty subscription rights and MANAGE_BILLING_PROVIDER take SUBSCRIPTION - Service Work's five take SERVICE Orders, pricing, tax and quotes deliberately stay on POS: a retail sale, a rental and a service job are all orders against the same price list, so they are the commerce spine rather than any one vertical, and an org running three verticals grants them once. No enforcement changes. getServiceType() is read only by RoleRightDTO and MemberSecurityController when they serialise a right for the editors — it decides which group a right appears in, never whether a check passes. Counts in RoleRightHierarchyTest updated in the same commit, as they must be: values 268->278, children 194->205, standalone 39->38 (MANAGE_ORG_MASTER_NOTE leaving), roots 74->73.