- Shipped
- October 18, 2026 at 6:56 PM UTC
- Author
- Kamo
- Commit
- f1b5ea6
SubscriptionService reads a subscription, its order, invoice and agreement by uid alone, in any tenant. POSController now checks the record is the session organization's before a staff right (VIEW_/MANAGE_ SUBSCRIPTION_*) reads or changes it (re-price, seats, add-ons, suspend/cancel/renew, approve/activate, mark paid, void, refund, issue); another organization's record is not found, and its customer still reads their own through the VIEW_OWN_* paths. A subscription id on the invoice and agreement lists must be the caller's organization's; only the agreement's customer may accept it. Rental assets and vendors by a market id no longer list another tenant's. Order notes get a door on the order itself (GET/POST **************** VIEW_/MANAGE_ORDERS), signed by the session's member; the retail-market note and draft-order routes no longer take the author from the body, and no caller writes a system note. No new rights: every gate was already the screen's.