- Shipped
- November 15, 2026 at 12:27 AM UTC
- Author
- Kamo
- Commit
- 1450bd3
Owner 2026-10-18 (IoT master §10 R7): an open, unexpired god-mode window passes tenant-right checks anywhere; GD eligibility alone passes them only while the session's organization is the platform org (orgs.is_top_level). The previous commit made every gate window-only, which forced platform staff to break glass inside the platform org itself. **************** implements it (same rule as **************** and MediaService AuthHelper). The platform org id comes from PlatformOrgIdCache: resolved once via findFirstByIsTopLevelTrue, cached 6h, last good id on failure, never a query per check; unknown = not the platform org (fails closed). System User sessions (SUDO_MEMBER_ID) stay window-only. All tenant-right gates converted last commit now use it, including ClinicalRightsGuard (no PHI-specific god rule exists) and the Impersonation same-org door. Deliberately break-glass-only gates keep isGodModeActive: account delete, org destroy/branding, PHI audit reads, PHI boundary, ChildOrgCreation, MemberSecurityController, ThemeBackground, DevMachine, MlosConfig SI-loan refusal, MLOS steward gate.