- Shipped
- August 13, 2026 at 2:33 AM UTC
- Author
- Kamo
- Commit
- 2ff9b45
Passthrough for POST /punches/{id}/void, the editor's delete key and the machinery behind merging two adjacent spans. Same authority as /correct, and for the same reason: an EMPLOYEE may void their own punch, because a member who cannot say "that double tap never happened" has no way to correct a record they are the only witness to. What they cannot do is make it count — the void lands on a timecard that still moves through the approval chain, and the reason is mandatory on every path. The actor is stamped from the SESSION, never from the body; a body-supplied actor is a body-supplied signature on someone else's wage record. Two tests, pulling in opposite directions, because this service runs anyRequest().permitAll() with hand-rolled per-handler auth: it must refuse a colleague's punch without ever reaching the relay, and it must admit the subject themselves holding no rights at all.