- Shipped
- 15 Agosti 2026, 01:20 UTC
- Author
- Kamo
- Commit
- 39bd0f3
@RequirePlatformRight + PlatformRightInterceptor replace three hand-rolled "is the caller a top-level-org owner" gates that were copies of each other, one per platform controller, each cross-referencing the others in its own comment. They were also wrong in the same way: owner-only, so a platform administrator granted a console's right could open its tab and be refused by every request it made. Ownership still qualifies — it resolves to every platform right. The annotation, not a path list, is what marks an endpoint platform-only; the interceptor is registered for /** so there is no second list to forget. A declared-but-empty annotation refuses rather than admits. system_user_access is retired as a read. EnterAsController, DomainController and the /network capability probe now ask for the SYSTEM_USER platform right, so the capability sits beside the rest of the platform's rights instead of in a table only those three endpoints knew about. The configuration singleton is edited from two tabs by two audiences, so the endpoint admits either right and then checks each field group against its own — holding MANAGE_VOIP_SMS must not let you retarget the extraction model. Platform sounds move to MANAGE_PLATFORM_SOUNDS; the org and member scopes stay on the tenant rights system, which is the correct spine for them. PlatformRightCoverageTest fails the build on a right that guards nothing, a platform controller with no guard, and any revival of the retired owner check. The unauthenticated-endpoint ratchet learns that an annotation enforced before the handler runs is a guard — its body-only scan could not see one.