- Shipped
- September 17, 2026 at 4:17 AM UTC
- Author
- Kamo
- Commit
- 4758fa8
There is one System User for the whole platform. Platform operators, and support staff holding a grant scoped to a single ticket's organization, enter a tenant as it through enter-as. Two checks treated "the caller is the System User" as enough on its own, for every organization and every account: - **************** behind PATCH /org/{id}/colors, upload-logo, both background endpoints and provision-theme: a System User session entered into org A could repaint, re-logo or re-theme any other tenant by putting its id in the path. - UserAccountEditPolicy's SYSTEM_USER arm, behind the member profile identity update and both personal-address endpoints: it answered for every account on the platform, ahead of the peerage rule, so that session could rewrite the sign-in identity of anybody, a god account included, and without the mailbox proof an owner is asked for. Now the branding arm passes only when the session's org is the org being edited, and the account arm only for an account with a membership in the session's org that is not a god account. Everything a support session does inside the tenant it entered is unchanged. OrgBrandingSystemUserScopeTest (through updateColors) and **************** pin both; every refusal test fails with its check removed. The policy takes MemberRepository now; its two test constructions follow.