- Shipped
- November 15, 2026 at 12:36 AM UTC
- Author
- Kamo
- Commit
- 8bc069a
Mirror the server rule (securityservice **************** shared **************** owner rule 2026-10-18): an open, unexpired break-glass window passes every right check anywhere; god eligibility alone passes only when the session's organization is the platform organization. lib/godMode: sessionOrgIsPlatformOrg (the layout-loaded org context's isTopLevel AND the same id as the session's orgID, compared as strings: no request, fails closed, and a tenant session on the platform host does not count), godPassesRightChecksFor / godPassesRightChecks; hook useGodPassesRightChecks. useUserInfo.checkRight / checkRole / checkAnyRole / checkAllRoles and the new **************** use it; the nav, settings pins and settings topics memo keys, the member page access gate and account merge follow. isGodModeActive stays "a window is open" (banner, audit labels, IoT window semantics).