- Shipped
- October 18, 2026 at 6:30 PM UTC
- Author
- Kamo
- Commit
- 9d50e15
KamoLOS enforced no right: kamo-internal's /api/los proxy was the only gate. LosRightsFilter now applies the proxy's own requiredRight() table (LosRights) to every /api/los/** request: a signed-proxy caller is judged on member_rights_applied, an OTK caller on its session's rights (or an open god-mode window). No member is a 401, a missing right a 403 naming it. Nobody loses access: same table, and the proxy's session rights are computed from the same applied rights (and the personal-loan tables hold no rows today). Org checks (TenantScope; a foreign id is a 404): offers get/send/accept/decoder/rescind and by-borrower; the offer e-sign sign route (envelope in the org, LOAN_OFFER only, and only the offer's borrower signs: 403 otherwise); products get/update/delete/toggle and by-market; fee waive; autopay get/enable/pause/cancel; payment methods **************** and payment methods named in pay-now/autopay; manual adjustment, promise to pay, pay-now, record-manual, draws and charge-off confirm by their loan; audit events by-loan/by-offer, and the regulator search is bounded to the caller's organization (OrgLoanAuditEventRepository). Identity: ProxyHmacFilter keeps the signed-header door (ON in production: LOS_PROXY_HMAC_ENABLED=true, verified live: an unsigned request is a 401) and adds X-OTK, the door the other services give a session holder such as the SI tool plane: the key is consumed once, and X-Org-Id/X-Member-Id are replaced by the session's, whatever the caller sent. The stale 'HMAC off in production' comments are corrected.