- Shipped
- 14 ஆகஸ்ட், 2026 அன்று 9:59 PM UTC
- Author
- kamo
- Commit
- 25e53c1
CREATE_ORG_CALENDAR_EVENTS is enforced: MemberCalendarService throws OrgCalendarForbiddenException when a member without it writes to the org calendar. The check resolves the right through findByMemberAndRight, which was not in the helper pattern, and \bforbidden\b does not match the capitalised exception name. The four SHARE_DOCS_* rights are enforced in ShareDocumentDialog through checkRole, not checkRight — a sixth helper name missed. All five were rendering 'Not yet enforced' against working permissions. Records a real finding while correcting the false one: the SHARE_DOCS_* checks are CLIENT-SIDE ONLY. /api/imaging/shares/by-alias and the member-search endpoints do not re-check them, so the rule is bypassable by calling the API directly. That is a genuine gap and a separate fix — it is not the same thing as a right that gates nothing, and conflating the two is what sent the previous triage after the wrong work.