- Shipped
- August 28, 2026 at 12:51 AM UTC
- Author
- Kamo
- Commit
- 4a5dda4
266357d0 was built with the wrong index. Its tree came from a stale local HEAD rather than from the staged one, so it carried none of the permissions work its message describes and instead reverted four commits that were already on main: 70b721a5 (image proxy serving another org's branding), b747b989 (force-cache pinning "no wallpapers" forever), 105f245c (the leads grid double-fetch) and 83ebadfd (the BL2/SW8 plans). app/lib/imageProxyCache.ts, orgThemeImages.ts and both their test files were deleted outright. This commit restores every one of those files to their state at 105f245c and adds the 20 files 266357d0 was supposed to contain. Net effect against 105f245c is exactly the intended change and nothing else. The permissions change, as originally described: THE HOME PAGE. "My Master Note" and "Our Master Note" were bespoke panes rendered straight out of page.tsx, gated on nothing, positioned by their own layout ids, and removable by nobody — so a member whose role withholds VIEW_NOTES had no Notes icon, no /notes page, and two notes on their home page anyway. They are registry widgets now, which is what the registry says it is for: one entry buys the grid, the drag, the ordering, the per-member show/hide, the settings screen and the five-right policy. Their layout ids change from master:mine / master:ours to widget ids, so a member who had dragged those two panes somewhere finds them back at their default place once. THE GROUPS. A security group is an APP, shown only when the organisation has that app switched on. Apps have been a two-level tree since 2026-08-24 and the groups now follow it: POS is "Lines of Business" (was "Commerce") with Retail, Rentals, Service Work, Subscriptions, Procurement, Mortgage Lending, Personal Lending and Patient Records under it. A right whose serviceType matches no group cannot be granted in any editor and nothing says so — Meetings, Mortgage Lending, Personal Lending and Games were in that state, 19 rights, ungrantable however the app was licensed. It is a COVERAGE test now: permissionAppSections.test.ts reads RoleRightType.java and fails if any app with rights has no group. Two more of the same shape: the job-title and department editors dropped the five Access Security rights and CONFIGURE_SYSTEM entirely, and the member tab titled its groups with the raw enum name. Every editor builds its groups through permissionGroupTree now, so none of them can hold a different taxonomy again. THE UI. Four screens rendered ~280 rights as a stack of accordions, one column about nine screens tall and flat in a way the apps no longer are. It is a console now: a rail of groups, nested as the org's apps are, beside a panel showing one group, with a granted-against-total meter on every rail row so the shape of a role is legible before anything is opened. Splitting commerce into child groups broke the cascade — denying ACCESS_COMMERCE would no longer nuke VIEW_SUBSCRIPTIONS one group over — so RightsSection takes a `context` prop of every right in every group.