- Shipped
- August 15, 2026 at 7:24 AM UTC
- Author
- Kamo
- Commit
- 480b2fa
Same bug as LoanController.get(uid), repeated: these controllers took a loan id off the path and handed it to a repository, so GET /api/los/statements/by-loan/42 returned another organization's statements for the asking. Loan ids are sequential. This matters more than it did this morning. KamoLOS is deployed — it runs as kamowslos-deployment and has for 78 days, with 15 real loans — which the earlier triage got wrong by looking for a deployment name that does not exist. These are live cross-tenant reads, not future ones. LoanScope is a component rather than a copied helper because the same three lines were needed in six controllers, and six copies is six chances to write == on a Long or skip the null check. It fails closed on a null org: X-Org-Id is only trustworthy while ProxyHmacFilter is enabled and it is not enabled in production, so a missing org must not act as a wildcard. Foreign and missing loans return the same 404, since telling them apart is most of what enumeration wants. Still unscoped and deliberately not touched in this commit: LoanAdjustmentController, LoanAuditEventController, **************** LoanStateRuleController and the by-uid halves of LoanOfferController. They need the same treatment, and some resolve an entity before a loan id is available, so they are not the mechanical case these three were.