- Shipped
- August 6, 2026 at 3:04 PM UTC
- Author
- Kamo
- Commit
- 4e08e01
All seven /api/docs/legal mappings authorized on org membership alone, so any authenticated member could list, edit, delete and publish legal packages — and audience-preview with allTeamMembers:true returned the whole active roster with emails and security levels. HrLayout's gate is client-side and the route is reachable through APIService's /api/docs/** forward. Every mapping now runs through one guarded() path: 401 without a session, then LegalPackageAccess — VIEW_EMPLOYEES to read, EDIT_EMPLOYEES or MANAGE_HRS_SETTINGS to write — then the body. The check lives in one place so it cannot drift per endpoint. The fingerprint was blind to the design publish freezes: move a signature field, publish a new design version, re-publish, and publish answered 409 "Nothing has changed", so the corrected layout could never be frozen and every future executor signed the stale one. templateUid, the design version number and a sha256 of designData join the Item tuple, and FORMAT moves LPFP1 -> LPFP2, which marks every existing package changed once — intended, and noted in the javadoc. LegalPackageContentService now owns the single design-resolution rule the snapshot and the fingerprint both use. Also: publish refuses a package with no documents and one with blank attestation wording (409 each), and PATCH can no longer mark a never-published package ACTIVE.