POST /service-jobs, gated on MANAGE_SERVICE_WORK

FeatureSecurityService
Shipped
August 27, 2026 at 4:26 PM UTC
Author
Kamo
Commit
9628feb

The create verb the work-order surface never had. app/commerce/service/new is a seventeen-line placeholder because there was nothing to call. Gated on MANAGE_SERVICE_WORK like every other write here. It is a CHILD of VIEW_SERVICE_WORK, so accepting view would still look gated while admitting anyone who can merely see the board — ServiceJobRightsGateTest drives the new handler with a view-only session and asserts the service is never reached. The tenant comes off the session and reaches the service as its first argument, where it becomes a predicate inside the query; the body's marketUid and customerUid name nothing about an organisation. A market or account belonging to another tenant is "not found" and answers 404, indistinguishable from one that never existed. CreateJobInput's components are asserted: no status, no jobNumber, no totals, no sign-off. The verb-set assertion now expects four POSTs, so the Next proxy for this surface still has to export all five verbs.

All changes

Like what you see shipping?

Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.

Start Free ForeverView Pricing