- அனுப்பப்பட்டது
- 18 அக்டோபர், 2026 அன்று 6:16 PM UTC
- எழுத்தாளர்
- Kamo
- கமிட் செய்யுங்கள்
- 987d2cd
POST /api/esig/envelopes (create and send) checked no right, so any org session could send any template out for signature; it now takes EDIT_DOCUMENTS, the right void and resend already take. The template reads (list, by-img, get, signers, design latest/versions/version) were org scope only; they now take VIEW_DOCUMENTS, as envelope reads do. Nobody who uses the screens loses access: the only sender is the template editor, which already needs EDIT_DOCUMENTS to open (init) its template, and EDIT_DOCUMENTS is a child of VIEW_DOCUMENTS, so every editor holds both.
