- Ya
- 2 Septemba 2026, 06:12 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 5d15b8c
MANAGE_REPORTS, appended to PlatformRightType, and a REPORT_CATALOG override row per report holding one of ALL_ORGS, PLATFORM_ORG_ONLY or PLATFORM_ADMIN_ONLY. This is a coarser gate than everything else in the framework and it sits in front of them: a report's own requiredRight decides what a member sees INSIDE a tenant, and row-level scope narrows further. This decides whether the tenant is offered the report at all, which is the platform's decision rather than the organization's. On the platform spine deliberately. A tenant administrator can edit their own security models, so a RoleRightType here would let a customer widen a report the platform had restricted. The three settings are INDEPENDENT conditions, not a ladder — a platform admin inside a tenant satisfies PLATFORM_ADMIN_ONLY and not PLATFORM_ORG_ONLY, and a member of the platform org who is not an administrator satisfies the reverse. Reading them as a ranking would quietly widen one of the two, and the widening would look like the feature working. A report with no row is ALL_ORGS, which is what every report does today — so this table starting empty changes nothing live, and restricting a report stays a deliberate act. Appended at the end of the right enum because getSortOrder() is ordinal(): an insertion would renumber the console. Grants are stored by name, so appending changes nothing already granted.