- Shipped
- September 4, 2026 at 5:21 AM UTC
- Author
- Kamo
- Commit
- 8d1ee54
A system bug already crossed the tenancy line in one direction. This adds the second visibility rule on top of it: a report a god-mode operator filed privately is visible to a caller with an OPEN god-mode window, to the member who filed it, and to nobody else. Written as three ORed terms rather than a nullable filter parameter, because there is no value of godMode that means "do not apply this" — the whole point is that it always applies. It goes into all four queries verbatim, beside the tenancy predicate that is already duplicated across them for the reason the repository spells out: a count computed under a different rule than the list it opens is a bug report waiting to happen. A badge counting reports the list will not show reads as a badge that refuses to clear. b.reporter.id is safe as an implicit join for the same reason b.reporterOrg.id is — the association is optional = false, so it cannot silently drop rows the way an implicit join on a nullable one does. A null viewerMemberId is the safe answer here: no row's reporter id equals null, so an unresolvable viewer falls back on `published` alone rather than matching every private report. published defaults to TRUE on the entity, in the builder and in the @PrePersist guard, matching the column default. A null written as NULL would be read back by the predicate as "not published", which would hide a report from the tenant that filed it because a builder omitted a field. canPublish on the detail DTO is deliberately not canManage. MANAGE_SYSTEM_BUGS is held continuously by platform administrators; this answers whether a break-glass window is open. Folding the two together would hand the whole point of the flag to the wrong set of people.