- Ya
- 27 Agosti 2026, 04:39 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 943171e
SW5 Task 3, controller half. CRUD for books, categories, tasks and options, plus GET /{bookUid}/tasks/by-code/{code} - the lookup a quote or work order performs when it holds a stored taskCode. That one is a single indexed query against idx_service_task_book_code, not a fetch-the-book-and-scan; it runs per line item over a catalogue of hundreds, which is why it is an endpoint. Reads need VIEW_SERVICE_WORK, writes need MANAGE_SERVICE_WORK. Both landed in SW1 and both already gate the nine service endpoints on POSController. The controller this one deliberately does not resemble is CommerceMarketController, which carries no @PreAuthorize anywhere and asks only whether a session exists - the same hole SW4 found on orders and SW1 found on service work. ServiceTaskBookRightsGateTest pins every handler, and separately pins that no mutation settles for the view right (MANAGE is a CHILD of VIEW in the rights tree, so accepting VIEW on a write is a silent downgrade) and that no handler accepts the customer's VIEW_OWN_SERVICE_WORK as an alternative. The tenant comes from the session and is passed as the service's first argument, where it becomes a predicate inside the JPQL. Nothing here loads a row and then checks whose it was. Path variables arrive as String and go through parseUuid, so a malformed id is a 400 rather than a Spring 500. 'Not found' means not found IN YOUR ORG, which is the only question the repository asked and the only answer a caller should get.