- Shipped
- September 2, 2026 at 8:50 PM UTC
- Author
- Kamo
- Commit
- da164b4
checkRight matches plain strings, so the gates worked without this — but the security role editor cascades grants through RIGHT_PARENT, and with the pair missing an administrator could grant MANAGE_SALES_SCRIPTS on its own. That leaves an author able to write a script in CRM settings while the Interaction Center tab, which takes VIEW, stays invisible to them: a grant that reads as complete and is not. Java has parented these since the enum change; this is the client catching up. Both rights also join the hand-maintained mirror in **************** It is deliberately partial, but what it carries has to match Java exactly, and every right added since the orders block has been mirrored. Verified against the real checkout rather than by eye — roleRightMirrorParity.test.ts skips silently here, because its JAVA_ENUM path points at Kamo/Java/ while the checkout is Kamo/Projects/. That check also reports 35 PRE-EXISTING drifts in the mirror, all ServiceType: the SUBSCRIPTION and SERVICE blocks still say POS, and the nine CALC_ rights still say null. None is touched here — they are unrelated to sales scripts and would be a separate change — but the parity test would fail on main today if its path were corrected, which is worth knowing before anyone corrects it.