Mint owner OTK with grant-all rights without DB round-trip

FixSecurityService
Shipped
April 30, 2026 at 5:06 PM UTC
Author
Kamo
Commit
a7781f8

After **************** assigns the Administrator role and writes member_rights_applied, the OTK-minting block was re-reading those rows via **************** inside the same @Transactional. Depending on Hibernate flush ordering relative to the JPA derived query, the just-written rows are not always visible to that read — when they are not, the OTK was minted with an empty/limited rights set, the new owner's session inherited that, and the org's settings sections + Plans & Billing tab stayed hidden until the next fresh login from login.<sub-org>. The owner is, by definition, an Administrator (grant-all) at this point, so build the rights list directly from RoleRightType.values() instead of going through the DB. The result is deterministic and independent of flush timing.

All changes

Like what you see shipping?

Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.

Start Free ForeverView Pricing