- Shipped
- August 27, 2026 at 4:20 PM UTC
- Author
- Kamo
- Commit
- c95b8d2
No order-mutation right existed anywhere. POSController's order endpoints and every pricing and tax handler in CommerceMarketController read the org off the session and checked nothing else, so any authenticated member of any role could create, edit, refund and re-status orders — and rewrite price lists, tax classes, tax zones, tax rates and customer tiers — inside their own org. Never cross-tenant; role simply meant nothing on those surfaces. Four rights rather than three: MANAGE hangs off VIEW in both pairs so that changing an order or a price cannot be granted without the ability to read what is being changed, and so that a write endpoint accepting the VIEW right is a detectable downgrade rather than an invisible one. VIEW_PRICING is not decoration — reading what the tax rates and price lists ARE is an ordinary finance and audit need that must not carry the power to change them. Max id was re-checked against origin/main immediately before writing: 272. A duplicate id is a Collectors.toMap failure in a static initialiser, i.e. every service that loads this enum stops booting. Pinned counts move 263/189/35/39 -> 267/193/35/39: all four are children and ACCESS_COMMERCE was already a root-with-children, so only two numbers move. Note: this commit also carries a five-line comment removal in RoleRightType.java made by a concurrent session in this checkout. `git commit --only` takes the worktree state of the path; the change is theirs, not mine, and is preserved here rather than discarded.