- Ya
- 21 Agosti 2026, 01:04 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 11765f4
enter-as gains a second reason to say yes. SystemUserEntryPolicy turns the caller's *** into the facts the shared SupportSystemAccessResolver takes, and that resolver — the same one MediaService uses to decide whether the support window shows a button — is the only thing consulted. The supportTicketId in the request body is advisory: it goes on the audit line and is not an input to the verdict, so naming somebody else's ticket, a closed one, or a random UUID changes nothing. A ticket-scoped session is registered with SupportSystemSessionRevoker before its one-time key exists, because the OTK is what puts it in a browser and a session that reached a browser without being findable could only be ended by its TTL. A blanket-right session is deliberately NOT registered — nothing about it can expire, and tearing it down on a reassignment would evict somebody entitled to be there. SupportGrantSweep re-derives every registered grant on a timer as the backstop for "MediaService died between reassigning the ticket and revoking the session"; it logs at WARN, because reaching it means a push was missed. Two things fixed on the way past: - The System User gate used **************** which reads administrator ROWS only. The /network button is drawn from platform-access/me, which also honours the top-level-owner and active-god-mode floors — so the platform's own owner saw ENTER AS SYSTEM MEMBER and got a 403 from it. Both sides now resolve the same way, which is what that class claims as its invariant. - Session fact parsing (memberID, orgID, isOrganizationOwner, GD+godModeActive) is now SessionPlatformFacts, read once. Two of those are floors that grant every platform right, and a second reader that got godModeActive slightly wrong — GD alone, say — would hand out the platform. Response now also carries the destination url. /network builds its own from the org row it holds; a caller coming from a support conversation has a ticket and no domain.