- Shipped
- August 25, 2026 at 2:11 PM UTC
- Author
- Kamo
- Commit
- 31fd3ed
The class carries @RequirePlatformRight, so the interceptor resolves the caller and refuses before any handler runs — a per-method check would have been one forgotten annotation away from a hole, and the endpoint reaches a prompts. The access check IS the defence. Model and effort are mapped from a fixed vocabulary, so a request body can express a different model and nothing else — never a flag. The audit row is written and COMMITTED before the dev machine is called, from its own bean: REQUIRES_NEW through a self-invocation is inert, and a row that only appeared on success would be missing the dispatches that hung. SessionPlatformFacts now comes from the shared library, so MediaService and this service read godModeActive the same way.