- Shipped
- August 7, 2026 at 6:10 AM UTC
- Author
- Kamo
- Commit
- fb8c874
GET **************** answers one page of the session org's directory. Search, ordering and paging happen in the database; a hostile ?size= is capped. Words are ANDed and LIKE metacharacters escaped, so a pasted email with an underscore narrows the search instead of widening it. The platform System User never appears. member-security now reads and writes the manager. Three rejections, in the order a caller hits them: not a team member of this org, themselves, or someone who already reports up through this member — the last would close the reporting line into a loop no query walking it could terminate, which is why it cannot live in the schema. The manager is resolved BEFORE anything is written. The save is one transaction across roles, rights, timeout and position; returning a 400 partway through would still commit everything written up to that point, so the response would report a rejected manager while the roles quietly changed. MemberAvatarUrlService is the home for avatar URL construction in new code. Several controllers carry private copies that have drifted — AccountController's still picks the photo extension with instanceof, which is false for a Hibernate proxy and serves a .png URL for a JPEG.