Gate DELETE /api/security/org/{id} behind active god mode

Shipped: 2 Agosti 2026, 18:25 UTC
Author: Kamo
Commit: 6b2cae4

The handler was `public void **************** Long id)` — no HttpServletRequest parameter at all, calling straight through to a bare deleteById. With ResourceServerConfig permitting every request and APIService relaying /api/security/** without gateway auth, destroying any tenant was one anonymous request against a sequential Long id. Nothing in the product calls it: the kamo-internal BFF at **************** exports only GET and PUT. Deleting a tenant is a platform-staff action, so require an authenticated session with god mode actually activated — eligibility (GD) alone is not enough, which the test pins.

All changes

Je, unaona nini kuhusu usafiri?

Kila moja ya hizi updates ardhi katika nafasi yako ya kazi moja kwa moja. Kuanza bure na kuangalia kukua wiki baada ya wiki.

Kuwa Huru Milele Mtazamo wa bei