- Shipped
- August 27, 2026 at 8:39 PM UTC
- Author
- kamo
- Commit
- 29a65ec
Task 8, the kamo-internal half. Six mirrors of the rights architecture; four of them live here. 3. app/lib/rightsHierarchy.ts MANAGE_BILLING_PROVIDER -> MANAGE_SUBSCRIPTION_SETTINGS 4. app/types/.../RoleRightType.ts the constant (277) and the ALL array entry 5. permissionAppSections.ts NO functional change needed — see below 6. SecurityRoleManager.tsx its inline duplicate of 5, kept identical Mirrors 5 and 6 turned out to need no code: they map ServiceType -> section, not right -> section, and the POS/"Commerce" row already exists. Because MANAGE_BILLING_PROVIDER carries ServiceType.POS it is grantable the moment the enum ships. Both comments were updated to name it, and updated IDENTICALLY, because permissionAppSections.test.ts pins the duplication rather than the fix — SecurityRoleManager.tsx does not import that file, and two copies that disagree is how one editor grows a section the others lack. THE ROUTE PREFIX. The plan specified the relay at /api/security/billing/provider and the route file at **************** Those do not match, so shipped as written the whole feature would 404 in the browser while every service was healthy and every build was green — the exact failure the plan itself warns has happened twice on this platform. The route ships at **************** instead, following the payroll precedent, and covers every future billing relay with no new file. billingRelayRoutePrefix.test.ts now reads the Java @RequestMapping and checks a catch-all actually covers it, so the mismatch cannot come back as a code review someone forgets to do. The route does NOT call .json() on a body-less response — a 204 from disconnect would otherwise throw and surface as a generic 500, making a successful call look broken. Pinned by the second test in that file. RED (test edited first, before any mirror was touched): FAIL rightsHierarchyParity > every edge matches RoleRightType.java exactly AssertionError: expected { onlyInTs: [], …(1) } to deeply equal { onlyInTs: [], onlyInJava: [] } FAIL rightsHierarchyParity > has the same number of children as Java expected [ 'CREATE_CONTACTS', …(192) ] to have a length of 194 but got 193 FAIL rightsHierarchyParity > matches the audited totals expected [ 'CREATE_CONTACTS', …(192) ] to have a length of 194 but got 193 FAIL rightsHierarchyParity > parents the billing provider right on commerce settings AssertionError: expected [] to deeply equal [ Array(2) ] - [ "MANAGE_SUBSCRIPTION_SETTINGS", "ACCESS_COMMERCE" ] + [] Tests 4 failed | 12 passed (16) RED for the route, with the directory named EXACTLY as the plan specifies **************** FAIL billingRelayRoutePrefix > has a catch-all route covering the relay mapping AssertionError: no catch-all route file covers /api/security/billing/provider — every endpoint under it 404s in the browser: expected false to be true FAIL billingRelayRoutePrefix > does not call .json() on a body-less response Error: ENOENT: no such file or directory, open **************** Tests 2 failed (2) GREEN, both files: Tests 22 passed (22) Proven able to fail, by mutation, observed verbatim: C. RIGHT_PARENT entry for MANAGE_BILLING_PROVIDER removed (TS drifts from Java, which is the whole reason the parity test reads the Java source): 4 failed | 12 passed — including "every edge matches RoleRightType.java exactly" with a non-empty onlyInJava D. The 204 guard replaced with an unconditional `NextResponse.json(await response.json())`: FAIL billingRelayRoutePrefix > does not call .json() on a body-less response AssertionError: expected 'import { NextRequest, NextResponse } …' to contain 'if (!text) return new NextResponse(nu…' Both reverted. VERIFICATION npm test — all 12 guard scripts pass, then Test Files 286 passed (286) Tests 3750 passed (3750) npx tsc --noEmit over the WHOLE repo — one error, and it is not mine: **************** error TS2552: Cannot find name 'useNavCounts' That file is ` M` in another session's working tree (+55 lines vs origin/main) and is untouched here. To prove these changes are themselves clean, tsc was re-run over a tree built from origin/main plus ONLY these seven files: zero errors except `Cannot find module '@/messages/en.json'`, which is an artifact of `messages/` being gitignored and so absent from a git-archive tree. Committed with `git commit --only` on explicit paths. This checkout carries dozens of other sessions' modified and STAGED files; `git show --stat HEAD` lists exactly these seven.