- Shipped
- August 29, 2026 at 7:26 AM UTC
- Author
- Kamo
- Commit
- c0141f4
`/api/security/receivables` is where Settings → Account → Receivables reads and writes. Two rights, not one: VIEW_RECEIVABLES reads the tab, MANAGE_RECEIVABLES changes it. Neither is a payout right — VIEW_ORG_FINANCES governs money leaving the organization, these govern the account it asks customers to pay INTO, and somebody who reviews commission batches has no business repointing it. The organization owner is an implicit holder, because a brand-new right is granted to nobody on the day it deploys including whoever would turn the feature on, and without that branch this ships dormant. The numbers go in but never come back. A read answers with the last four digits, which is what an administrator confirming the right account is on file actually needs; changing one means typing it again in full. Writes are partial — only the keys the body carries are applied — so the screen can save the printing switch without re-sending an account number it never displayed. OrgReceivablesService verifies the ABA check digit rather than just the digit count. A transposed pair is the commonest typing error there is and it passes a length check while naming a different bank or none, and the only cheap moment to catch it is while somebody is looking at the field. It also refuses to leave the organization printing an instruction it cannot complete, checked on the RESULT of the update: turning printing on without an account and clearing the account while printing is on are the same mistake seen from two sides. Changing where an organization's incoming payments land is refused while impersonating, matching CommissionController. The quote surfaces resolve the block through QuotePresentation, so the staff preview and the customer's page cannot disagree about the document — including about its absence. A decryption failure yields no block rather than an error: a quote that renders without payment details is recoverable by the customer calling the agent named on it; one that will not render at all is not.