- Shipped
- November 15, 2026 at 7:22 AM UTC
- Author
- Kamo
- Commit
- e396c49
**************** kept its own copy of the old grant-all test (every row it has is GRANTED), so on the next boot a role saved with only the rights it grants (the roles API keeps only the rows it is sent) had every missing right inserted GRANTED - permanently. Seen live: the lab org's "Underwriter Only" role (2 rows) became 463 GRANTED rows when SecurityService restarted, and its member signed in with every right. The sync now asks the one shared rule (kamo-shared-library d3bf4cff GrantAllRoles: a GRANTED row for every right, or the Administrator role); a narrow role's missing rows get NOT_SPECIFIED plus the usual per-role seeds. Tests: RoleRightsSyncBatchInsertTest 3 (2 new), every RoleRightsSync*Test, **************** 5.