- Shipped
- September 23, 2026 at 8:47 AM UTC
- Author
- Kamo
- Commit
- e1c31cc
POST /members/create, /create-team-member and /bulk-create, and GET /members/lookup-user, now require MANAGE_MEMBERS or an open god window. They checked only for a session, so any member could create accounts in their organization, and lookup-user told any member the name, id and verification state behind any e-mail address on the platform. Every owner of all 25 live organizations holds MANAGE_MEMBERS, and kamo-internal's supersededRights.ts already names it as the gate for creating a member. PUT /member-security/{id} now requires MANAGE_MEMBER_SECURITY or an open god window for roles, direct rights, the session timeout, and any change of department or job title (both are levels of the rights waterfall), on your own record as well as anyone else's. It checked only that caller and member shared an organization, so any member could PUT their own roleIds with the Administrator role in them. The official title and the manager stay editable on your own record, as the profile's Position card offers them. GET requires the same right unless the record is your own. Also the two failures on main: - **************** flagged **************** and #status. Both accept X-Internal-Auth only and fail closed. The scan reads one method body and does not follow calls, so the helper is renamed validateInternalAuth, a name it recognises. - **************** failed four times with a NullPointerException: 10a8d81 added AppliedJobStamp to the sign-in path, and the test never supplied one. It now supplies a mock.