- Ya
- 15 Agosti 2026, 03:43 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 75253b1
ContactRestController checked ownership carefully — orgOf, userOf, assertBookIsMine, assertGroupIsMine, and 404 rather than 403 so somebody else's id is never confirmed to exist — and checked no right at all across 26 endpoints. VIEW_CONTACTS was enforced only by navRegistry hiding the app in the browser, so the members whose roles withhold it were refused the page and served by the API; CREATE, EDIT and DELETE_CONTACTS gated nothing anywhere. Ownership and rights are complementary, not redundant: ownership decides whose contacts, rights decide whether the verb is allowed at all. Both run now. assertRight reads the rights the session already carries, from the same attribute OrgIdExtractor and UserIdExtractor read, so the answer is whatever the organization's security model resolved for this member. It fails closed on a missing session, a missing rights array, or a rights value of the wrong type — a session that cannot be classified is not one to wave through. God bypasses, matching every other rights check in the platform. Books, groups and their bulk operations follow the contact they hold: creating a book or a group is CREATE_CONTACTS, moving contacts between them is EDIT_CONTACTS, and both delete paths plus bulk-delete are DELETE_CONTACTS. Import is creation and the three export paths are reads. No seeding. All three verbs track VIEW_CONTACTS exactly — 28 roles, 47 members — and no member holds the parent without them, so nobody loses anything.