- Ya
- 25 Agosti 2026, 14:11 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 31fd3ed
The class carries @RequirePlatformRight, so the interceptor resolves the caller and refuses before any handler runs — a per-method check would have been one forgotten annotation away from a hole, and the endpoint reaches a prompts. The access check IS the defence. Model and effort are mapped from a fixed vocabulary, so a request body can express a different model and nothing else — never a flag. The audit row is written and COMMITTED before the dev machine is called, from its own bean: REQUIRES_NEW through a self-invocation is inert, and a row that only appeared on success would be missing the dispatches that hung. SessionPlatformFacts now comes from the shared library, so MediaService and this service read godModeActive the same way.