- Ya
- 3 Septemba 2026, 20:52 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 197b591
MANAGE_MEMBER_SECURITY passed the change-password gate, which made "can administer members" and "can take over any member's account" the same right. They are not the same thing. A password is the one credential that is supposed to be unknown to everybody but its owner, and an administrator restoring access to a locked-out colleague already has password RECOVERY for that — which proves control of the member's mailbox instead of bypassing it. The gate is now: the member themselves, or a god-eligible caller (eligibility alone, as before, not an active god-mode toggle). The org-scope check behind it is unchanged, so a god from another tenant is still refused. Denials are logged; a security control that refuses silently is one nobody can investigate. The right still governs everything else an administrator does to a member's security record. It just no longer sets their password. PasswordChangeAuthTest is new — this controller had no coverage at all, which for an authorization gate is where a test earns its keep. Eleven cases, and every negative one asserts the password was never written rather than only checking the status code. Confirmed non-vacuous by restoring the old condition: exactly the two regression tests fail and the other nine still pass. Verified: mvn test, 2,029 tests, 0 failures.