- Shipped
- 15 ஆகஸ்ட், 2026 அன்று 1:20 AM UTC
- Author
- Kamo
- Commit
- 3da4e42
@PlatformAdminOnly now names the platform right it requires (defaulting to MANAGE_ORGANIZATIONS, which is what this service's platform surface is about) and the verdict comes from PlatformRightsResolver — the same rules SecurityService enforces. It used to decide for itself and admitted owners and god mode only, so a platform administrator granted MANAGE_ORGANIZATIONS could open the Organizations tab and be refused by every request it made. Identity resolution stays here, where the caller arrives as forwarded headers rather than a *** session; only the verdict moved. Also stops treating User.isGod alone as half the god-mode test: eligibility means "may activate", and the header says whether they have.