- Shipped
- August 5, 2026 at 8:59 PM UTC
- Author
- Kamo
- Commit
- 26ad3bf
members.security_level is a VARCHAR holding the ImageAccessLevelType NAME — 'PRIVILEGED', 'MEMBER', 'TEAM_MEMBER'. The session builder tested the value with instanceof Number and fell back to 0 when it failed, and it always failed, so every *** on the platform was issued at PUBLIC(0) no matter the member's real level. ImagingController.listDocuments skips any image whose accessLevel exceeds the token's level, so this silently hid every document stored above Public: a 200 with an empty documents array and nothing in any log. It went unnoticed because essentially every upload so far has been Public — the HR Resources library is the first surface where a document was filed at Member level, and its uploader, a PRIVILEGED member, could not see their own file. resolveSecurityLevel now accepts the enum name, a numeric string or a number, and falls back to PUBLIC for anything unrecognised. Existing sessions keep SEC=0 until they are re-minted at next login.