- Ya
- 7 Agosti 2026, 01:54 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 4ee31c0
Resolves the session, authorizes, and relays to CommissionService with the org and member stamped from that session — never from anything the caller sent. This is the only place rights are checked: SecurityService runs anyRequest().permitAll() with hand-rolled per-handler auth, so an endpoint that forgets its check fails OPEN and is reachable through the public API relay. Three rights rather than one, so separation of duties is expressible: with a single grant, whoever issues a commission could also release the payout and cancel the hold that exists to catch them. Money-moving and payout-destination actions hard-refuse under impersonation. Impersonation mints a full session as an arbitrary member, so without that refusal a god admin could enter as somebody, point payouts at their own bank, withdraw, and cancel the hold. The organization owner is an implicit holder. A brand-new right is granted to nobody on the day it deploys — including to anyone who could turn the feature on — so without an owner branch the feature ships dormant and unreachable. /me/opportunities is served here rather than relayed, because SecurityService owns the opportunities model; registering those repositories in CommissionService too would give one shared-library model two writers. It unions the member's split rows with the reservations where they are the primary agent, because the agent's own commission produces no split row and a query checking only one side silently hides half a member's earnings.