- Shipped
- August 14, 2026 at 8:05 PM UTC
- Author
- Kamo
- Commit
- 83cab06
The Legal & Compliance settings tab is the only writer and is now offered only to a member holding MANAGE_HRS_SETTINGS *and* MANAGE_LEGAL_AND_COMPLIANCE, so the server demands the same. Hiding the tab while leaving the endpoint open to half its former audience would be a gate in name only. READING stays any-of. Two screens gated on two different rights display this one string, and the new-package dialog seeding its default for a package author who is not an HRS administrator is the feature, not an edge case. requireAll is separate from require rather than a flag on it: an any-of list and an all-of list read identically at the call site, and getting that backwards silently opens the write. It fails closed on the same conditions require does.