- Ya
- 3 Agosti 2026, 02:51 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 4091496
The settings endpoint required MANAGE_EMAIL_AVATAR_SETTINGS and nothing else, so it shipped dormant: a brand-new right is held by nobody until an admin assigns it to a role, which left every org unable to configure the feature — including unable to turn the identity tier off — until someone noticed. Right 149 shipped the same way on bulk reassignment and had to be granted after the fact. Adds the implicit owner path that org branding already uses for the same class of decision: an owner never needs to be granted a right over their own org. The delegable right still works and is still the way to hand this to someone who is not the owner. The flag is read from the nested teamMember payload rather than the top level, because that is where KSessionService actually puts it — the obvious top-level read compiles fine and silently evaluates to "not an owner", which would have left the endpoint just as dormant. Both the Boolean and its string form are accepted since the session round-trips through Redis.