- Shipped
- July 6, 2026 at 7:04 AM UTC
- Author
- Kamo
- Commit
- a1b34b5
The account vault held documents per-PARTY (shared human) but authorized access per-ACCOUNT — two HIGH multi-human defects on a joint loan: - PII leak / lockout: any account member could read EVERY party's SSN card and tax returns, while a co-borrower who was not an account member was locked out of their OWN documents. Now a borrower is authorized ONLY for the party that IS them — bound via party.memberId, or a verified email match (party application email == login email), which also stamps party.memberId for the staff tab. Operators (LOS_VIEW_PIPELINE) still see all parties; the /parties list is narrowed to the caller's own party. - Notification misrouting: DOC_REQUEST and DOC_REJECTED always emailed the account primary, so a co-borrower was never nudged and the primary received another human's rejected-doc details. DOC_REQUEST now goes to EVERY borrower on the loan (de-duped); DOC_REJECTED goes to the party the document belongs to (resolved from the enriched view's accountBorrowerPartyId), falling back to the primary only when the party has no contact of its own.