Check the caller's *** session rights, not member_rights_applied

Shipped: November 15, 2026 at 12:08 AM UTC
Author: Kamo
Commit: c59c526

Every DocsService gate asked hasRightApplied, so grant-all owners whom SecurityService's session allows were refused, and each check cost two DB reads. MemberRights now answers the caller from the request's *** rights list in memory (SessionRights), and anybody else (share recipients, compliance audiences, no-session internal calls) from the database with grant-all honoured the way SessionRightsResolver.atSignIn does (GrantAllRoles + grantAllSessionRights). Legal review notifications use the shared RightHolders so owners are counted. The session KToken now carries the rights list. No god bypass added; GD alone grants nothing.

All changes

Like what you see shipping?

All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.

Start Free Forever View Pricing