- Shipped
- 6 Agosti 2026, 21:05 UTC
- Author
- Kamo
- Commit
- de0ba64
Filing is queued AFTER COMMIT and OFF the request thread. Finish is @Transactional in a service that also serves WOPI; holding a connection across N ESigService reads, a PDFBox merge and a MinIO write is how a pool of ten starves. Submitting from inside the transaction would also race the commit, which is the failure LegalAfterCommit was written for. A failure in the worker is not a failure of Finish: the attestation is written and the row falls to EXECUTION_INCOMPLETE. Downloads resolve by imgId through the legal endpoints, never through POST /api/imaging/list — that pages org-wide BEFORE filtering assocObjectId, so a member's own package silently vanishes past 100 rows at assoc 1, which the lead Files tab shares. And never through ImageService.downloadDocument either: that checks the CALLER's stale-able security level, and design §8 is explicit that the assignment record is the access path and DocManager the convenience copy. Three mappings, three authorizations: the member's is identity, HR's read is the HR read right, and HR's file action is the WRITE right because it uploads a document into someone's library. The file action is synchronous — an admin clicked it and "that member's security level is too low" is the answer they need, not a 200.