- Shipped
- August 6, 2026 at 9:43 PM UTC
- Author
- Kamo
- Commit
- 80d0c4f
DELETE /imaging/delete/{imgId} is the one destructive imaging path and was not wired to the issued-document guard. ImageService.deleteDocument authorizes on org membership ALONE — not even the access-level ceiling — so any authenticated colleague could soft-delete another member's executed employment package out of that member's own Docs tab. /folders/move-doc is the same shape and additionally answers with the document's metadata, whose description IS the package title. Both now resolve the row and apply the per-subject rule. Deliberately not through getDocumentMetadata: that read imposes the caller's security-level CEILING, and a ceiling on delete would newly refuse a member deleting a document classified above their own clearance. A missing row is not a refusal — the service still owns the 404. markConverted sat OUTSIDE the try/catch bracketing upload(). An exception there escaped file() uncaught: attach() never ran, executedImgId stayed null, and the status stayed EXECUTED — a row that reads as complete, offers no download, and whose only repair mints a second Img. Not cosmetic either: getDocumentPdf returns null unless isConverted is true, so the artifact behind that "complete" row is one NEITHER legal download endpoint can serve. Moved inside the try, so the row lands EXECUTION_INCOMPLETE and HR's Retry action can reach it. Also: a refused byte read now writes a DENIED PHI row (recordDeniedByteAccess had zero production call sites, so a colleague walking eleven imgIds was indistinguishable from silence); the four remaining title/history leaks are guarded; the anonymous-401 and no-right-403 cases are pinned on both new HR mappings; and the Filing javadoc no longer claims a detached proxy answers getId() — Organization uses FIELD access, so it works only because tx1 initializes that instance while a session is open.