- Ya
- 22 Julai 2026, 18:33 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 9915ef3
Uploading a logo to a child org 403'd with no way to succeed: canManageOrgBranding only admitted the org owner, and the isGodModeActive fallback could never return true. Backend god gates read godModeActive off the *** session, but nothing ever wrote it — the toggle lived only in browser localStorage, so every server-side god bypass was unreachable in practice. - canManageOrgBranding now also honors MANAGE_ORG_BRANDING, scoped to the org being edited. Rights are granted per-membership, so holding the right in one org must not confer branding on another org whose id is passed in the path; sessionGrantsOrgBrandingRight is split out pure and tested for exactly that. - Adds POST /api/security/session/god-mode, which writes godModeActive into the caller's own session. Eligibility is read from the session's GD flag, never from the body, so a non-god caller cannot self-grant. - PATCH /{id}/colors had no authz at all — any authenticated caller could repaint any org by id. Now gated like its sibling branding endpoints. - 403 bodies name the right instead of claiming owner-only.