- Shipped
- August 7, 2026 at 1:13 AM UTC
- Author
- Kamo
- Commit
- 9c5e7ca
The three commission rights gate a feature that did not previously exist, so NEW_RIGHT_SEEDS deliberately says nothing about them - that mechanism carries an existing grant forward so a deploy never silently REMOVES access, and using it here would hand money-moving power to people who never had it. What they need instead is a role-type default, which did not exist. Two parts: - templateSeedSettingFor gains a DefaultRoleType overload granting the finance rights on ADMINISTRATOR templates only. GRANTED, not FORCE_GRANTED: an org must stay able to revoke a money right from one administrator on their member profile, and FORCE_GRANTED overrides every later layer of the waterfall. - ensureRoleTypeTemplates creates the ADMINISTRATOR row for models that lack one. Default-role rows are lazy, created only when someone saves a model's defaults, and syncSecurityModelRoleRights iterates that table - so without this the default would apply to every branch model except the never-customised ones, silently, and those are the ones most likely to be relied on as-is.