- Shipped
- October 18, 2026 at 5:27 PM UTC
- Author
- Kamo
- Commit
- 7c53248
@RequireRight (any-of, tenant RoleRightType) enforced by TenantRightInterceptor before the handler, the tenant counterpart of @RequirePlatformRight: no session is a 401, a missing right a 403 naming it, an open god-mode window passes, god eligibility alone does not. - CommerceMarketController (~120 ungated handlers): reads ACCESS_COMMERCE; market/vendor/location/shipping setup MANAGE_SUBSCRIPTION_SETTINGS; the catalogue MANAGE_PRODUCTS, stock MANAGE_INVENTORY, retail customers MANAGE_RETAIL_CUSTOMERS, carts/draft orders/shipments MANAGE_FULFILLMENT, rental assets MANAGE_RENTALS, order notes VIEW_/MANAGE_ORDERS. - POSController **************** and the legacy mortgage routes (MLOS rights); RetailProduct/RetailInventory; CommerceVendorCategory. Stock by product id is now org-scoped. - CRM settings writes (custom forms, lead vendors, markets, status labels, import templates) take MANAGE_CRM_SETTINGS; template reads/detect also CREATE_LEADS. Their reads stay org-wide by decision (vocabulary, no customer data). - Lead callbacks follow the lead page's LeadViewGate; schedule/move/resolve take MANAGE_LEAD_CALLBACKS. - MortgageConnect: MLOS_VIEW_PIPELINE / any LOS write right, or a party to the application (was any org member, NPI). - OAuthConfig: CONFIGURE_SYSTEM or owner (any member could replace secrets). - SubdomainBranches: credential writes need CONFIGURE_SYSTEM or owner; the DNS log and retry no longer accept ANY org id (cross-tenant). - Encounter start/end/close-chart take MANAGE_ENCOUNTERS, not just VIEW_CHART. - Entitlements /{memberId}/feature and /invalidate: the caller's own id only. Grant backfill: **************** seeds each new right on the boot that introduces it, into roles, security-model templates and the override tables: **************** entry from MANAGE_SUBSCRIPTION_SETTINGS (the commerce settings screens), fulfilment and purchase approval from ACCESS_COMMERCE (the pipeline), callbacks from every lead-working right and ACCESS_VOIP, visits from VIEW_CHART. Tp01EndpointRightsCoverageTest fails on any handler in these controllers with no right check and no recorded decision.