- Ya
- 27 Agosti 2026, 16:26 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 9628feb
The create verb the work-order surface never had. app/commerce/service/new is a seventeen-line placeholder because there was nothing to call. Gated on MANAGE_SERVICE_WORK like every other write here. It is a CHILD of VIEW_SERVICE_WORK, so accepting view would still look gated while admitting anyone who can merely see the board — ServiceJobRightsGateTest drives the new handler with a view-only session and asserts the service is never reached. The tenant comes off the session and reaches the service as its first argument, where it becomes a predicate inside the query; the body's marketUid and customerUid name nothing about an organisation. A market or account belonging to another tenant is "not found" and answers 404, indistinguishable from one that never existed. CreateJobInput's components are asserted: no status, no jobNumber, no totals, no sign-off. The verb-set assertion now expects four POSTs, so the Next proxy for this surface still has to export all five verbs.