- Shipped
- April 19, 2026 at 7:25 PM UTC
- Author
- kamo
- Commit
- c36d293
Surfaces the new branch-type security model in the UI: - branch-types tab gains an "Edit Master Model" button (hidden when the org has a branchTypeID assigned) that opens the model editor in master mode: no name field, no branch-types chip, save hits /master-model. - Model editor (both add-child-model and edit-master-model) gains a new "Default Security Roles" section after "Allowed Apps", with tabs for Administrator / Team Member / Member / DEFAULT and 5-value settings (FORCE_GRANTED, GRANTED, NOT_SPECIFIED, FORCE_NUKE, NUKE). - New useAppliedModel() hook fetches /api/security/applied-model once and exposes isForced(rightName, roleType) for consuming editors. - Security roles, departments, job titles, and per-member roles-permissions pages hide rights force-locked by the applicable templates: * security-roles: system roles use their matching template + DEFAULT; custom roles use DEFAULT only (Q11 answer A). * departments + job-titles: DEFAULT only (non-role-specific). * member page: member-type template (TEAM_MEMBER vs MEMBER) + DEFAULT (Q8 answer C, type-first evaluation order). New proxy routes: /api/security/master-model (GET/PUT), /api/security/applied-model (GET).