- 已装运
- 2026年4月19日 19:36 UTC
- 作者
- Kamo
- 提交
- 64db301
MemberSecurityController now enforces the three assignment invariants defined in the brainstorm spec: - saveMemberSecurity: before persisting the caller's requested roleIds, augments the set with the mandatory system role(s) based on member type: Member-typed members always get roleMemberID; Team-Member-typed members always get roleTeamMemberID; Team-Member owners additionally always get roleAdminID. LinkedHashSet preserves caller ordering while deduping. - updateMemberAccess: when the owner flag toggles, the Administrator role is added or removed on the team-member to keep role assignments in sync with ownership. Rights-applied recalculation runs in the same transaction so downstream reads see the updated effective permissions immediately.