- Ya
- 19 Aprili 2026, 22:47 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 8a4f86f
Adds the data layer for gating /network child-org creation by member type: - New CREATE_CHILD_ORG right on RoleRightType (id 131). - Three new boolean columns on ChildOrgSecurityModel: appliesToMembers / appliesToTeamMembers / appliesToOwners When true, the model's branch types are offered to that member-type bucket on /network. A model with all three false is never surfaced as a creation option to anyone — it only governs existing orgs. - ChildOrgSecurityModelService gains 13-arg create/update overloads that accept the new flags; the legacy 10-arg signatures delegate through. - ChildOrgSecurityModelDTO round-trips the three flags. - AppliedModelEnforcementService exposes the gate logic that every caller shares: enum ChildOrgCreatorType { MEMBERS, TEAM_MEMBERS, OWNERS } getBranchTypesCreatableBy(org, creatorType) → the list of branch types that belong to models which apply to that creator type and have at least one branch type. **************** creatorType) → boolean predicate. Creator-type classification: OWNERS = team-members with isOrganizationOwner=true, TEAM_MEMBERS = other team-members, MEMBERS = everyone else. Right-check (CREATE_CHILD_ORG) is intentionally NOT baked into these helpers — callers combine both checks so the helper can also back read-only queries.