- Shipped
- August 15, 2026 at 1:23 AM UTC
- Author
- Kamo
- Commit
- 9ab31e7
Granting the two rights on org_role_rights changes nothing anybody can observe. member_rights_applied is the flattened snapshot the session and the server-side checks read, and it only refreshes when something recalculates — the next SecurityService boot, or the next edit to a member, role, department or template. Neither is something this run can promise, and until one happened MediaService would be refusing /api/meet/create for members whose roles had just been granted START_MEETING: the seed would have reported success while the lockout it exists to prevent was still live. So it closes its own loop, calling **************** per organization — the same path an editor takes, rather than hand-writing rows next to computed ones where a disagreement between the two would be invisible. A failure there is logged, not fatal: the grants are committed and correct, a boot-time recompute still picks them up, and aborting would skip every runner after this one.