- Shipped
- 12 மே, 2026 அன்று 6:08 AM UTC
- Author
- kamo
- Commit
- c2eddc4
When /settings/account loads for a user who lacks CONFIGURE_SYSTEM on the current org, the previous behavior was a silent redirect to /settings — a dead-end for child-org owners whose admin permission lives in a different org. The classic case: Daniel owns GNosia (child) and is a plain team- member of KamoCRM Inc. (parent). When he clicks an "Apps & Features" link from the parent's UI it lands him on **************** — where he legitimately can't configure — and he gets bounced. Now the page: 1. Detects the redirect is about to fire. 2. Fetches /api/security/org/my-networks for the user. 3. Finds an owned-by-this-user org that ISN'T the current one and whose domain setup is complete. 4. POSTs /api/security/enter-as for that org to mint an OTK. 5. window.location.replace to **************** **************** 6. /validate exchanges the OTK, sets the *** cookie on the owned org's subdomain (where Daniel IS the admin), and forwards to the original tab. Apps & Features loads in the correct org context. Fall through to /settings only when the user doesn't own any other org (the original behavior is preserved for non-cross-org cases).