- Ya
- 27 Agosti 2026, 09:53 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 1c64482
SW6b Task 3, controller half. POST/PUT/DELETE /{jobUid}/lines/..., POST /{jobUid}/notes, POST/DELETE /{jobUid}/vendors/..., PATCH /{jobUid}/signoff and PATCH **************** Reads stay on VIEW_SERVICE_WORK; every one of the eight is MANAGE_SERVICE_WORK. MANAGE_SERVICE_WORK is a CHILD of VIEW_SERVICE_WORK, so a mutation cloned from the read handler beside it accepts view on a write and still looks gated in review. ServiceJobRightsGateTest drives all twelve handlers with a view-only session and asserts the service is never reached -- a handler that acts and then checks returns 403 having already written the row. Both ids reach the service on every child endpoint, and the service resolves the child with the job uid and the org as predicates in one query. Without the parent one, DELETE /{jobUid}/lines/{lineUid} reaches any line in the org through a URL that looks entirely correct. A note's author is memberId(req) and never the body: NoteInput carries a body and nothing else, on a record with no edit path precisely so that what it says stays what was said. Clocking out of a visit nobody clocked in to is a 409 naming the visit's state, not a 400 and not a 500 -- the request is well formed and the row exists, and what is wrong is the state. Engaging the same vendor twice is a 409 too. The test now reads the mapped handler names off the controller and asserts this class drives every one of them, so a ninth endpoint added and forgotten here fails rather than being covered by nothing. The verb-set assertion is widened to all five verbs: the Next proxy for this surface must export GET, POST, PUT, PATCH and DELETE or every save answers 405 from Next with nothing in the server logs. Mutation-tested, 19 mutations, each a distinct named failure: the right check deleted on each of the eight, MANAGE swapped for VIEW on each of the eight, the check moved after the service call, the session org replaced with a literal, and one verb changed.