- Shipped
- November 12, 2026 at 2:41 AM UTC
- Author
- Kamo
- Commit
- c48f323
GET /api/security/picture-frames now answers every signed-in member with {frames, shared, managedShared, canCreate, canManageShared}: personal frames (PICTURE_FRAME_WIDGET), the org's shared frames whose audience reaches the caller, and — for MANAGE_SHARED_PICTURE_FRAMES holders — every shared frame with its audience and reach. Each frame gains shared, updatedAt and createdBy. - POST {shared:true, audience} creates a shared frame (manager only, 24 per org); personal creation and its 12-per-member ceiling are unchanged and count personal frames only. - PUT/DELETE/media upload/media delete on a shared frame: any manager in the org; records updated-by. Media stream and GET /{id}: managers or members in the audience. - POST /audience/preview -> {count, sample[8]} for managers. - Audience = everyone | memberIds | departmentIds | jobTitleIds | teamIds, over ACTIVE, live, human team members (no system/fake users). A viewer costs two small queries; reach reads the org roster once per request. Rights are read from the session OR member_rights_applied, so a newly granted right works without signing in again.