- Ya
- 2 Septemba 2026, 23:32 UTC
- Mwandishi
- Kamo
- Ahadi ya
- eb6efaf
A second door beside the same-org god-mode one. Gated on the new IMPERSONATE platform right via @RequirePlatformRight, where the existing door is gated on the session carrying GD. Kept as two handlers rather than one with a flag. Their caller gates are genuinely different, and @RequirePlatformRight has no in-handler variant by design — a gate you have to remember to call is one that eventually gets forgotten on the endpoint that mattered. Who may be ENTERED AS is a separate question, and ImpersonationTargetRules answers it as a pure function over resolved facts: refused for the top-level org, yourself, a membership with no user, the System User, a god account, a platform administrator, or anyone who could not sign in themselves. The same function decides whether a row in the picker is selectable, so the list cannot offer somebody the endpoint would turn away. The same-org door deliberately does NOT share those rules. It operates inside the caller's own organization, which for a god admin is usually the top-level one, and on people who are frequently administrators themselves — both hard refusals here. Folding the two together would break the settings page or quietly widen this one. **************** fills the picker. It is the one endpoint in that controller naming an organization other than the session's, which is why it is a separate handler rather than a parameter on /search: the class's promise that /search cannot be widened by accident stays true. Refused people stay in the list with a reason rather than vanishing from a search for a colleague who is plainly in the org. workspaceHostFor moves off EnterAsController into WorkspaceHostResolver, since both doors need the identical answer. Two copies of "which host is openable" is how one keeps sending operators to a certificate interstitial after the other stopped. Its tests moved with it.