- Shipped
- October 14, 2026 at 12:33 AM UTC
- Author
- Kamo
- Commit
- b8014ab
GET /api/security/guided-tours answers which tour steps the signed-in PERSON has been shown or skipped, as the union over every membership of the same user — a step seen in one organization is seen in the next. POST /guided-tours/steps marks steps on the signed-in membership's guidedTours row in member_ui_preferences (no new table), read-merge-write in one transaction with @RetryOnDbConflict so two tabs cannot erase each other. Rules in GuidedTourProgress: seen outranks skipped, the first date is kept, ids are validated and bounded. Its own path rather than a ui-preferences key, so a running tour publishes under guided-tours, which nothing listens to, instead of members. RoleRightsSyncService seeds each SHOW_TOUR_<APP> on its first boot to whoever holds any right in that app, its nested apps or (for a nested app) its parent; E-Signatures, which has no right of its own, seeds from Documents. The two member-tracking rights are never a source.