- Shipped
- September 23, 2026 at 2:27 AM UTC
- Author
- Kamo
- Commit
- 3cdd805
Regression in f7b2bd5, live on kamowsmedia. canReadSession (MediaController, copied into SessionFacesController and ChatSessionMembersController) admitted a member of a session's own type only for membership or SUPPORT_TICKET; SOCIAL fell through to a bare refusal. A SOCIAL session carries no MediaSessionMember rows for the org side AT ALL by design (the org's half is modelled on the connection, not an invite list, per createMessage's own SOCIAL branch) — verified against production: six SOCIAL sessions, zero with any membership row. So every one of them failed "is member", and with no SOCIAL exception, the read gate 403'd the social inbox outright: messages, faces, member roster, receipts and translate, for every legitimate agent — including SocialChat.tsx's own read of the transcript it needs to render at all **************** The write side (createMessage) already had the right rule for SOCIAL; the read side never learned it, and having the same logic hand-copied into three controllers is exactly how that kind of drift happens. Pulled both into one new component, SessionAccessGuard (membership, SUPPORT_TICKET's requestor/ assignee/org-support-staff, and now SOCIAL's connection-org match), and pointed MediaController's read gate AND its createMessage SOCIAL check, SessionFacesController and ChatSessionMembersController all at it — one place, so the two can no longer disagree. Re-checked kamo-internal's actual readers of every endpoint this guard covers (grepped origin/main for every `/sessions/${...}` and `messages/${...}/translate` caller): CHAT and the meeting-invite flows (useMeeting.ts, meetingInvitees.ts) always create explicit member rows and were never at risk; SUPPORT_TICKET was already handled; SYSTEM_BUG and EXEC2EXEC are read exclusively through **************** and never through these endpoints, so refusing non-members for both remains correct. SOCIAL was the only gap. Tests: SessionAccessGuardTest pins **************** for SYSTEM_BUG and EXEC2EXEC directly on the new shared component, including the exact regression (a caller with ZERO membership rows on a SOCIAL session, matching production). Mutation verified: removing the SOCIAL branch turns exactly that test red. Full `mvn test` green (1052 tests) before this commit.