- Shipped
- October 18, 2026 at 6:16 PM UTC
- Author
- Kamo
- Commit
- 987d2cd
POST /api/esig/envelopes (create and send) checked no right, so any org session could send any template out for signature; it now takes EDIT_DOCUMENTS, the right void and resend already take. The template reads (list, by-img, get, signers, design latest/versions/version) were org scope only; they now take VIEW_DOCUMENTS, as envelope reads do. Nobody who uses the screens loses access: the only sender is the template editor, which already needs EDIT_DOCUMENTS to open (init) its template, and EDIT_DOCUMENTS is a child of VIEW_DOCUMENTS, so every editor holds both.