- Ya
- 2 Septemba 2026, 06:43 UTC
- Mwandishi
- Kamo
- Ahadi ya
- e3ed5e5
GET/PUT /api/security/reports/catalog, both gated on MANAGE_REPORTS on the platform spine. The list comes from the REGISTRY, not the override table: an operator has to be able to restrict a report that has no row yet, which is every report until somebody touches one. The check itself went into ReportScopeResolver.mayRun, which the catalogue, the runner, the pickers, the exporter, the saved-view list and the schedule sweep all already cross. Adding it to each of those instead would have been six chances for one of them to disagree — and the one that disagreed would be the one that showed a report the platform had hidden. It sits IN FRONT of the report's own rights, and god does not pass it. Break-glass widens what a member may see within their organization; this is a question about which organizations a report exists for at all, and a god in a tenant is still in that tenant. ReportVisibilityService fails OPEN, which is the opposite of everything else here and deliberate: an unreadable override table would otherwise make every report on the platform vanish, and the reports underneath are still gated by their own rights and their own row-level scope. Losing this table costs a restriction, not a disclosure. Setting ALL_ORGS deletes the row rather than storing the default. A restricted report stops its existing schedules, and the run is recorded FAILED with "the schedule's owner no longer has access" — the same audit trail as revoking somebody's right, which is the same thing happening.