- Ya
- 11 Mei 2026, 02:10 UTC
- Mwandishi
- Kamo
- Ahadi ya
- cc93419
**************** / updateModel / deleteModel and **************** now invoke recalcAllMembersUsingModel after persisting changes — every org pointed at the model (own master or via branch type) gets member_rights_applied refreshed in the same call. The branch-type delete path also recalcs orphaned child orgs before the row is dropped so their applied-model resolution is correct when the model lookup falls back. **************** writes a freshly-computed rights array into an existing *** Redis entry, preserving TTL + every other field, so live tabs can pick up admin-driven changes without a logout/login cycle. SessionRefreshController exposes POST /api/security/session/refresh — the caller's own *** is resolved from cookie or X-OTK, the live waterfall runs, and the result is written back. Cross-member spoofing is impossible by construction: there is no member-id parameter. RightsDiagnosticsController exposes GET **************** — returns the full waterfall: cascade sources (org roles, dept + dept roles, job title + jt roles, direct overrides), the applied model + non-NOT_SPECIFIED template entries by role type, the live resolved rights split into **************** and an inSyncWithLive flag that surfaces drift between the persisted member_rights_applied snapshot and what the live waterfall produces right now. Auth: must be in the target's org and either be the target, hold **************** or have god mode active.