- Ya
- 14 Agosti 2026, 00:19 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 329025d
Relays the new **************** surface and enforces who may reach it. TimecardService holds the engine and no session; this holds the session and decides. SecurityService runs anyRequest().permitAll() with hand-rolled per-handler auth, so a handler that forgets its guard is not weakly controlled — it is uncontrolled and reachable from the public internet. Mapped under the existing /api/security/payroll prefix on purpose: kamo-internal reaches it through a catch-all BFF route, and a new prefix would 404 in the browser while every service is healthy and every build is green. Four tiers: - MANAGE_PAYROLL_PROVIDER (199) writes credentials and connects or disconnects OAuth. This is the ability to decide WHERE an organization's hours are transmitted, which is why it is its own right. - MANAGE_HRS_SETTINGS (45) reads the connection and its health. - MANAGE_TIMECARDS (183) covers employee mapping and sync history. - FINALIZE_PAY_PERIODS (198) transmits a committed batch — the same tier as committing the export, because it is the same act. Test Connection sits with the write right rather than the read one: it is an outbound call made with stored credentials, and letting anyone who can view the page fire it hands them a way to probe the org's payroll vendor. The OAuth exchange does NOT forward an org id. TimecardService takes it out of the HMAC-signed state, so a code obtained for one tenant cannot be redeemed against another even by a caller holding the right in both. Adds put/delete to TimecardServiceClient, which had only get/post.