- Shipped
- August 27, 2026 at 4:21 PM UTC
- Author
- kamo
- Commit
- 08a79ca
The client half of closing the order-mutation hole. SecurityService now gates 39 order, pricing and tax endpoints on four new rights; these are the two mirrors of the Java enum that have to move with it, or the rights exist on the server and are ungrantable from the UI. rightsHierarchy.ts gains four edges — VIEW_ORDERS and VIEW_PRICING under ACCESS_COMMERCE, MANAGE_ORDERS under the first and MANAGE_PRICING under the second — which is what makes the editor cascade agree with the server's normalisation. RoleRightType.ts gains the four constants AND their four _values entries; a constant left out of that array is invisible to everything that iterates the enum, and the permission editors iterate. No permission-section change was needed: all four carry ServiceType.POS and the Commerce row already exists in both permissionAppSections.ts and its inline duplicate in SecurityRoleManager.tsx, so they are grantable on arrival. Both comments are corrected to say so rather than leaving the count stale. No dictionary change either — right labels are the Java `display` string mirrored verbatim, not an i18n key. Service Work's five added nothing to kamo-translation-dictionary for the same reason. Parity total 189 -> 193. Verified against the Java source by rightsHierarchyParity and roleRightMirrorParity, both of which read kamo-shared-library directly; full suite 278 files / 3603 tests, 0 failures.