- Shipped
- 4 Septemba 2026, 05:22 UTC
- Author
- Kamo
- Commit
- 7f1592e
Posting a report now offers a Publish switch to an operator with an open god-mode window. It defaults to off: the report stays with god mode until somebody releases it, and POST /{id}/published releases or withholds one afterwards. The write rule is four lines and unspoofable. A client's `publish` is read ONLY from a caller with an open god-mode window; for everybody else it is discarded rather than refused, because the field is not offered to them and a value arriving from an ordinary member is either a stale build or hand-written JSON — neither is a reason to fail a bug report at the moment somebody is trying to tell us something is broken. For a god-mode caller a null and an explicit false land in the same place: a flag whose purpose is to keep a report away from the tenant must not turn itself on because a field went missing. Gated on god mode, NOT on MANAGE_SYSTEM_BUGS, and the difference is the point. A platform administrator holds that right continuously and may triage every report; deciding who can SEE one takes the deliberate act of breaking glass. So godMode() reads **************** which is the one place GD (permanent eligibility) is combined with an open window — reading either alone would grant this to those operators at all times, or to nobody. The read rule is applied twice on purpose and neither is redundant. The query stops an unpublished report appearing in a list; maySeeUnpublished stops it being fetched by id, including by a manager who holds the right but has not broken glass. changeStatus gets the same check: those callers have no way to learn the id, but "they could not have found it" is not an access rule, and it would otherwise be the one endpoint where a private report can be acted on by somebody it is hidden from. 404 rather than 403 throughout, matching the tenancy check — a 403 confirms the id exists. Publishing is announced like a status change, because it is the same kind of event for the badge: a report becoming visible joins the unread count of every manager who could not see it a moment ago. Skipped when nothing changed, so re-pressing the toggle does not wake every console.