- Shipped
- August 28, 2026 at 1:40 AM UTC
- Author
- Kamo
- Commit
- ceea5ce
Three member-settings surfaces were open to people they cannot mean anything for. Each gate is on the MEMBER TYPE or the org's apps, never on checkRight — checkRight returns true for every right under active god mode, and the page's canViewOtherMemberAccount ORs in rights that have nothing to do with the subject **************** among them). getMemberType() defaults to 'MEMBER', so every one of them fails closed on a session whose type has not resolved yet. Plans & Billing: team members only. The plan, the subscriptions, the invoices, the payment methods and the seat all belong to the business; a plain member holds none of them, so the tab was showing them the company's money. Gated on the VIEWER, so an owner opening someone else's page keeps the administrative path. The /settings card is gated the same way — a card that opens a tab which will not render is worse than no card, exactly as Commissions beside it. Ringtones & Alerts: gated on the same condition as NavTop's phone icon, which is now one function (hasPhoneAccess) rather than two copies of the same &&. The subtab is nothing but the configuration of the phone that icon opens — which ringtone, which device, how loud — so a member with no phone was being handed controls that cannot change anything they will ever hear. Audio, Video and Event Sounds are untouched: those are the meeting devices and the app's own notification sounds, which every member has. Legal & Compliance: team members, and an org with both the Docs and HR apps. Rather than inline the new conditions, they fold into legalBadgeAppliesTo, which NavTop's signature button and the count provider behind its badge already share. That button is a link straight to this tab, so a fourth copy of the condition would let it outlive its own destination and drop the member on their profile with no explanation; the provider goes quiet on the same condition instead of holding a STOMP subscription and a 60-second poll for a count that is 0 by construction.