- Shipped
- August 15, 2026 at 6:15 AM UTC
- Author
- Kamo
- Commit
- 0e5b16e
MANAGE_MATERIALS and MANAGE_SOCIAL_MEDIA counted as enforced in the audit and every site was a .tsx file. Behind them 29 endpoints checked ownership and no right: six materials controllers and SocialTimelineController. Reads take VIEW_MATERIALS or VIEW_SOCIAL_MEDIA, writes take the MANAGE right. Recording a material view event is filed as a read deliberately — it is telemetry produced by looking at a material, so gating it on MANAGE would break analytics for exactly the people the analytics are about. Minting a public link goes the other way: it is a disclosure decision, not a read. servePublic stays open. It serves a signed, time-limited link, authenticates by token and has no session to read a right from, so gating it would break every shared link. MetaOAuthController, SocialInboundController and the internal social endpoint are untouched for the same reason — an OAuth callback, a provider webhook and an internal caller have no member. AuthHelper.requireRight is new here and fail-closed from the first line.