Seed the finance rights onto every branch model's ADMINISTRATOR template

FeatureSecurityService
Shipped
August 7, 2026 at 1:13 AM UTC
Author
Kamo
Commit
9c5e7ca

The three commission rights gate a feature that did not previously exist, so NEW_RIGHT_SEEDS deliberately says nothing about them - that mechanism carries an existing grant forward so a deploy never silently REMOVES access, and using it here would hand money-moving power to people who never had it. What they need instead is a role-type default, which did not exist. Two parts: - templateSeedSettingFor gains a DefaultRoleType overload granting the finance rights on ADMINISTRATOR templates only. GRANTED, not FORCE_GRANTED: an org must stay able to revoke a money right from one administrator on their member profile, and FORCE_GRANTED overrides every later layer of the waterfall. - ensureRoleTypeTemplates creates the ADMINISTRATOR row for models that lack one. Default-role rows are lazy, created only when someone saves a model's defaults, and syncSecurityModelRoleRights iterates that table - so without this the default would apply to every branch model except the never-customised ones, silently, and those are the ones most likely to be relied on as-is.

All changes

Like what you see shipping?

Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.

Start Free ForeverView Pricing