Legal package CRUD at /api/docs/legal/packages

Shipped

August 6, 2026 at 2:01 PM UTC

Author

Kamo

Commit

36d7a39

List, create, get, update and delete, with ordered binder refs and audience rows replaced as a set. Org comes from the session on every path — DocsService is permitAll and OTKPreAuthFilter continues the chain without a token, so the controller's extractKToken IS the authentication. Cross-org department, job title, member and binder ids 400 explicitly rather than silently writing nothing.