- Ya
- 15 Agosti 2026, 02:44 UTC
- Mwandishi
- kamo
- Ahadi ya
- 7e20070
CREATE, EDIT, DELETE_DOCUMENTS and MANAGE_STORAGE all have real live features, so nothing here is deletable. VIEW_DOCUMENTS is client-only in navRegistry, the same shape as notes, and the four write rights gate nothing anywhere. Recorded rather than implemented because the surface is larger than it looks: 35 endpoints in ImagingController, 2 in DocumentController, 13 in BinderController, and the actual file upload is not in DocsService at all — it is ConversionService's /api/conversion/imaging/upload. CREATE_DOCUMENTS cannot be fully enforced without touching that fourth service, so a partial pass would ship a right that is enforced on folder creation and bypassed by uploading a file. The ImageAccessLevelType checks already in ImagingController are real but orthogonal: access level decides which documents, these rights decide whether the verb is allowed at all. The seeding decision is the part worth carrying forward. DELETE_DOCUMENTS and MANAGE_STORAGE are granted to the Administrator role only, in all 14 orgs, while VIEW/CREATE/EDIT go to 28 of 42 roles. 14 members can delete today because nothing checks and will stop being able to — that is the security model being honoured for the first time, not a regression, and seeding to preserve today's behaviour would overwrite the decision everywhere. So: a right that is differentially granted carries intent and must not be seeded; a right nobody holds at all, as with START_MEETING, carries none and must be. Rights resolve from the model attached per branch type on **************** through the waterfall into member_rights_applied, which is what enforcement should read. The verb mapping for all 50 endpoints is in the document, along with the two calls worth re-checking and a note that hasRightApplied is a database read per request on hot download paths.