- Shipped
- September 23, 2026 at 10:03 AM UTC
- Author
- Kamo
- Commit
- f30b26a
ESignTemplateService's signer/design handlers (getSigners, upsertSigners, reorderSigners, deleteSigner, saveDesign, getLatestDesign, listDesignVersions, getDesignVersion, revertDesign) proved a template existed with existsById/findById and stopped there — no org filter at all. initTemplate and getTemplateByImgId resolved a template by imgId alone with the same gap, so org A handing over org B's imgId reached B's template uid and every signer's name/email, and could then save or revert B's design, or delete/rewrite B's signers, from a template it never owned. Every handler now goes through requireTemplateInOrg (findByUidAndOrgId) or, for the imgId lookups, the shared library's new findByImgIdAndOrgId — 404 for another org, same as getTemplate/ updateTemplate already did. Writes (updateTemplate, initTemplate, upsertSigners, reorderSigners, deleteSigner, saveDesign, revertDesign) additionally require EDIT_DOCUMENTS, the right SignatureRequestsController already requires to act on a document; reads stay org-scoped only. Depends on kamo-shared-library@9bde243b **************** pushed first. New tests: ESignTemplateOrgIsolationTest (org isolation on **************** getSigners/upsertSigners) and ESignTemplateControllerTest (EDIT_DOCUMENTS gate on writes, not on reads). TemplateLayerVersioningTest and its saveDesign/revertDesign calls updated for the new orgId parameter.