- Shipped
- August 6, 2026 at 6:16 PM UTC
- Author
- Kamo
- Commit
- d236803
A separate controller with a separate funnel, because authorization here is identity and not an HR right. Routing these through guarded() would mean either locking every employee out of their own paperwork or widening LegalPackageAccess until the templates grid and the audience preview's roster are open to the whole org; the class does not hold a reference to LegalPackageAccess so the shortcut is not available. No mapping takes a member id or an org id — both come from the session. Service ResponseStatusExceptions keep their status: 404 not-yours, 409 already-finished, 422 not-acknowledged and 503 esign-unavailable are four different instructions, and one of them means the member already succeeded. An unexpected exception is a fixed-string 500: echoing e.getMessage() is tolerable on the HR surface, but this one every employee can reach. KToken extraction moved to security/SessionKToken so this is not its third verbatim copy.