- Ya
- 15 Agosti 2026, 06:18 UTC
- Mwandishi
- Kamo
- Ahadi ya
- a333875
The lead assignment picker needs the directory to return only people who can actually work a lead, so /team-members/search takes a requiredRight. An unrecognised name is a 400 rather than an ignored parameter: silently dropping a filter widens a permission boundary, which is the wrong way to fail. A right nobody holds returns an empty page without querying, since the alternative is an empty IN list the database will not parse. Who holds a right moves into RightHolderResolver, which the legacy assignable-members endpoint now uses too. The walk was already copied across five call sites and the two lead-assignment ones have to agree about who may receive a lead — better that they agree by asking the same question than by happening to hold the same code today. The remaining three are untouched.