- Shipped
- August 26, 2026 at 9:25 PM UTC
- Author
- Kamo
- Commit
- efb1ee8
On QuoteController rather than POSController: this controller enforces a right on every handler, POSController enforces none on any order endpoint, and it resolves sessions from the OTK attribute, the X-***-Token header and the *** cookie. Gated MANAGE_QUOTES because no order-mutation right exists to reuse. 409 for a state conflict the caller can retry after, 404 for a quote that is not there — matching get/update/revise/cancel. A malformed id is already a 400 from parseUuid before either branch is reached.