- Shipped
- August 29, 2026 at 7:26 AM UTC
- Author
- Kamo
- Commit
- c3a68a5
Six columns on `orgs` and the wire contract for printing them on a quote, so a company that receives one knows where to send the money without telephoning to ask. The numbers are AES-GCM encrypted at rest through SecretCipher, the same envelope the GoDaddy credentials use, and carry `@JsonIgnore` for a sharper reason than that: `GET **************** serialises this entity whole and needs no session. An organization that has not switched printing on has published nothing, and a whole-entity serialisation must not do it for them. The last four digits sit beside the ciphertext in the clear so a settings screen can say "•••• 4417" without holding a key. `ACH_ON_QUOTES` is a nullable Boolean, not `NOT NULL DEFAULT FALSE`. A NOT NULL add against a populated table is the one column shape Hibernate's ddl-auto cannot apply, and a column that silently failed to be created takes down every service that maps it. Null resolves to false everywhere, which is the safe default for a field that publishes a bank account. **************** owns the rule that the block prints whole or not at all: printing on, plus BOTH numbers. A payment instruction missing half its routing information is one an accounts-payable clerk still acts on, and the transfer comes back days later with a fee attached — silence sends them to the agent named further up the page instead. It takes the decrypted numbers as arguments rather than reading them, because the ciphertext needs a Spring bean and this class is deliberately the one static resolution the staff preview and the customer's page share. VIEW_RECEIVABLES (293) and MANAGE_RECEIVABLES (294) are a new root and its only child, NOT a branch of the payouts subtree. The two are opposite directions of money and opposite risks: VIEW_ORG_FINANCES reads what is leaving, and the harm from a substituted deposit account is every invoiced customer paying a stranger. A controller who reviews commission batches has no business editing it. Ids re-derived from origin/main; 288-292 stay burned.