- Shipped
- October 18, 2026 at 6:04 PM UTC
- Author
- Kamo
- Commit
- 69f5815
Owner decision 5 (security gaps fixed with the tools that use them): - /api/webinar: booking (available types, bookable times, a type's sessions, schedule, join) needs REQUEST_WEBINAR (or MANAGE_SUPPORT / MANAGE_WEBINAR_SCHEDULES), the rights the schedule wizard and nav already gate on; My Webinars and leaving a session need VIEW_MY_SCHEDULED_WEBINARS or REQUEST_WEBINAR (or support management, or presenting a type). A type or session must be one the caller's organisation is offered (its own or its parent's); a type's presenter hours, its own or offered. Until now any signed-in member could book, join or list any organisation's sessions by id. Existing rights only, so nobody who uses the screens loses access. - Meet M1/M2: an SI may bring another SI into (or take one out of) a meeting it created or takes part in (the Tool Plane's meetings_add_si, on a teammate's request); START_MEETING alone never lets an SI place SIs in other people's meetings. People keep the rule they had.