- Shipped
- August 25, 2026 at 1:07 AM UTC
- Author
- Kamo
- Commit
- ea9449b
Seven blocks across five controllers ended their org-resolution with, in effect: if the server name is localhost or a bare IP, return whichever organization the database lists first. They are labelled "for development/testing" and they run in production. getServerName() is not the browser's host. Behind the ingress it is the in-cluster address, which is exactly the shape these match — so anything reaching these controllers without a JWT org claim and without a resolvable forwarded host was handed the first organization's security roles, master model, applied model, branch types and security model. Not the caller's organization: the first one in the table. Nothing replaces them. Every one of these methods already returns null when no organization can be identified, and the callers already reject on null; the fallback existed only to make a local run work without a host, and a local run now names its organization explicitly with ?org=. Pure deletions — 0 insertions. Verified on a clean clone rather than in the working tree, which currently carries another session's in-flight PHI work: 951 tests pass.