- Shipped
- October 18, 2026 at 9:17 PM UTC
- Author
- Kamo
- Commit
- 5792d4c
CanvaController checked only that a member was signed in: anyone in the organization could drive its Canva round trip (create, list, export, import, brand templates, autofill) and connect or drop a connection. Now the connection routes (status, connect-start, disconnect) take VIEW_MARKETING, the Canva settings tab's right, and the workspace routes take VIEW_MATERIALS, the Materials page's; every VIEW_MATERIALS holder holds VIEW_MARKETING (its ancestor; 108 of 108 in production), so nobody who opens either screen loses a route and no grant is needed. The recipe and schedule lists take VIEW_MATERIALS and removing one takes MANAGE_MATERIALS, as saving one already did. CanvaRightsTest pins every Canva handler to a right.