- Shipped
- August 12, 2026 at 10:25 PM UTC
- Author
- Kamo
- Commit
- 4ed6c6c
Passthrough for GET /members/{id}/range, the period graph's read. from/to are forwarded only when present so TimecardService can resolve the member's own pay period — forwarding "?from=&to=" would bind to blank strings downstream and silently defeat that default for every org with a pay calendar. Identity is checked with resolveRole and no right, exactly as /day already does. The two requirements pull in opposite directions and a right-based gate gets only one of them: it must not become a way to read a colleague's hours, and it must admit the subject themselves holding NOTHING, because a member in the RESTRICTED tier has no rights at all and still has a statutory right to their own record. TimecardRangeAuthTest covers both directions plus the query building, because this service runs anyRequest().permitAll() with hand-rolled per-handler auth — a mapping that forgets its check is reachable from the public internet through APIService's wildcard forward.