- Shipped
- July 7, 2026 at 4:40 AM UTC
- Author
- Kamo
- Commit
- e3ac6c7
Two prod issues from the securityProvider-mirror change: 1. Enter-as-System-Member failed with "No membership in the organization's security provider" for every child org. All orgs' security_provider_id had been pointed at the top-level KamoCRM org, but the System User deliberately has no member there (SystemUserBackfillService skips is_top_level), so the provider-membership gate in EnterAsController always failed. Prod data reverted so every org self-points (login for the 5 orgs with their own domain is unaffected; the only orgs whose *.kamocrm.com subdomain login depended on the mirror have zero login history). New child orgs now self-point by default; only web-alias subdomain children inherit the parent's provider (the grouping key their "<alias>.<parentdomain>" login resolution needs). 2. Full-access admins (e.g. optionone owner) saw limited options: their member_rights_applied froze at the RoleRightType count that existed when the membership was last edited. RoleRightsSyncService grows *role* rights when the enum grows but never re-flattened members' applied snapshots; only the System User dodged it via its own boot backfill. New MemberRightsBackfillService re-flattens every member's applied rights on boot (after role-rights sync), via the existing chunked/transactional **************** Idempotent; per-org failures isolated.