Catalog edits reach only the caller's organization; own-order callers cannot comp or price themselves

Shipped

October 22, 2026 at 9:08 PM UTC

Author

Kamo

Commit

3d70ae9

Every update and delete of a subscription plan, price, feature, add-on, bundle, volume discount, promotion or agreement template now checks that the row belongs to the caller's organization (404 otherwise). Before, a tenant admin holding the catalog right could rewrite the platform's prices. A caller holding only CREATE_OWN_SUBSCRIPTION_ORDERS can no longer create an order paid by COMP, carrying custom pricing, or billed to another member.