- Shipped
- September 8, 2026 at 6:36 PM UTC
- Author
- Kamo
- Commit
- 7ee7d09
Reported on harmonyhomeloans, whose owner saw the icon in the top bar for an app their organization does not have, cannot enable in Apps & Features, and whose child-org security model marks NOT_AVAILABLE. Every other app option in the nav registry pairs an entitlement with a right — `organization.isCrm && checkRight('VIEW_LEADS')`. Games was the only one that asked for the rights alone, with a bare `|| isOrganizationOwner` on top of them. Neither half of that answers "does this organization have the app": - Rights are not entitlement-filtered. PLAY_CHESS and PLAY_HOLDEM are seeded onto org roles wholesale, so they stay granted — and checkRight keeps answering true — on a tenant whose plan never included Games. - Ownership is not a purchase. The owner branch exists so that a right granted to nobody on its first day is still reachable by the person who grants it. So the icon was drawn, and the menu under it — which DID ask for the app — was empty. The rule was written twice and the two copies drifted. It is written once now, in gamesAccess.ts: one row per child of Games carrying its entitlement, its right, and whether ownership stands in for a missing GRANT of that right (never for a missing app). The nav gate, the nav menu and the games menu inside a chat window all read it, so the icon is drawn exactly when there is a game behind it. The chat menu had the same defect independently and is fixed by the same rule. NavToolButton now renders nothing when it has no items and no header. The gates are still what should keep an option off the screen; this is the backstop that keeps a wrong one from being a clickable control that opens onto nothing. Verified against the live projection for harmonyhomeloans.net: 14 features, none of them GAMES, KAMO_UNIVERSE, CHESS or HOLDEM. Run through the real Organization and the real gate, the old gate returned true and the new one returns false, while the apps the organization does have still appear. The browser was never the enforcement — see the companion MediaService commit, which adds the app check the chess, Hold'em and Cheddar endpoints never had.