28 unenforced becomes 26 — AI models and usage are gated
MANAGE_AI_MODELS gates all four endpoints of AiModelController and VIEW_AI_USAGE both of AiUsageController. Neither checked a right before, only org ownership. ...
Administering models and reading usage take the rights that name them
AiModelController and AiUsageController checked organization ownership and no right. The 403s already in the model controller compare provider.getOrganizationId...
30 unenforced becomes 28 — voicemail is gated, call routing is kept
VIEW_VOICEMAIL and MANAGE_VOICEMAIL now gate VoipVoicemailController, which asked for a right only when playing back a recording in a PHI organization and for n...
Working with voicemail takes a right, not just handling PHI
VoipVoicemailController required VIEW_CALL_LOGS on exactly one path — playback, and only when the organization handles PHI. Listing voicemails with their transc...
32 unenforced becomes 30 — mailbox administration gated, email logs deleted
VIEW_EMAIL_ACCOUNTS now gates the administrative reads on MailboxController and MANAGE_EMAIL_ACCOUNTS gates every write. Both were client-only before: the whole...
Mailbox administration takes a right, and three endpoints get a session
MailboxController enforced no right at all. MANAGE_EMAIL_ACCOUNTS existed only as a checkRight in the browser and VIEW_EMAIL_ACCOUNTS was referenced nowhere, so...
Keep a security model's app grants off the catalog
The Allowed Apps tab showed "Not Available" for every app and snapped back whenever another option was picked. loadModels() runs from a mount-only effect, so i...
Gate platform uploads on MANAGE_PLATFORM_SOUNDS, not org ownership
An operator granted "Manage Platform Sounds" on the Platform Administrators page saw the Sounds tab — the console gates on the right — opened the upload dialog,...
37 unenforced becomes 32 — CRM contacts and leads are gated
Contacts: all 26 endpoints of EmailService's ContactRestController now take the verb that names them. They checked ownership carefully and no right at all, with...
Every contact endpoint takes the verb that names it
ContactRestController checked ownership carefully — orgOf, userOf, assertBookIsMine, assertGroupIsMine, and 404 rather than 403 so somebody else's id is never c...
Creating and deleting a lead take the rights that name them
LeadController is one of the better-gated controllers in the platform — VIEW_LEADS, EDIT_LEADS, ASSIGN_LEADS, REASSIGN_LEADS_MANUALLY, VIEW_UNASSIGNED_LEADS and...
Stop the letter-fallback org logos from flashing
An org with no logo shows its initial, and on /network that initial blinked continuously. Three things stacked up. PlatformRightsProvider wraps the whole app, ...
41 unenforced becomes 37 — the document verbs are gated
CREATE, EDIT, DELETE_DOCUMENTS and MANAGE_STORAGE now gate DocsService's ImagingController and DocumentController and ConversionService's upload endpoints. The ...
Uploading a file takes CREATE_DOCUMENTS, like every other way of making one
The document rights are enforced in DocsService as of this change, but the upload endpoints are not in DocsService — kamo-internal's app/api/imaging/upload prox...
The document verbs are enforced, as the org's security model resolves them
ImagingController checked ImageAccessLevelType and nothing else, and DocumentController checked only that a session existed. Access level is a real control but ...
A loan id is not a credential — scope every LoanController read to the org
LoanController.get(uid) took a loan id and returned whatever it found. Any caller who reached the service got the loan, balances and borrower included, whicheve...
43 unenforced becomes 41 — the two notes placeholders are deleted
Mirrors the shared-lib removal of SHARE_NOTES (72) and MANAGE_NOTES_SETTINGS (73): the TS constants and the registry array, the one parent-map edge in both righ...
Renaming a member is an admin act, and now has a gate
The member profile's legal-name card was self-only, so an admin who typed a name wrong on the create form could never correct it — MemberCreateForm asks for pre...
46 unenforced becomes 43 — the notes endpoints are gated
Fifth cluster. The Notes backend is KBService, not SecurityService: the entity sits under donotmodify/dao/beans/security/ and kamo-internal proxies /api/notes/*...
Every notes endpoint takes the right that names it, and hasRight fails closed
NotesController checked no right on any of its ten endpoints. VIEW_NOTES was enforced in exactly one place — navRegistry.ts, hiding the Notes app in the browser...
Stop a page-2 request from cancelling the folder you just opened
Junk, Trash, Archive and every custom folder showed the same mail — whatever was on screen before them. The server was not the problem: replaying listMessages a...
Close the add-path route around the platform-admin lockout guard
POST replaces an existing administrator's rights, so it can take them away as well as give them — but only the PUT and DELETE paths checked whether the edit wou...
Let a granted administrator actually see Platform Administration
The section gate and the settings menu topic still asked useUserInfo's hasPlatformAdminAccess, which is owner-of-the-top-level-org or an open god-mode window an...
Send an operator with no Configuration tab somewhere real
SYSTEM_USER and MANAGE_UNIVERSE gate surfaces that are not tabs on this page, so somebody holding only those is a platform administrator the page guard admits a...
The meet seed recomputes applied rights instead of waiting for a boot
Granting the two rights on org_role_rights changes nothing anybody can observe. member_rights_applied is the flattened snapshot the session and the server-side ...
48 unenforced becomes 46 — meet create and join are gated
Fourth cluster of the 48, and it split three ways rather than the two the design predicted. The design attributed the enforced MANAGE_MEET_SETTINGS check to Ch...
Draw the callback markers as soon as the summary loads
The summary lands after the grid has drawn its rows, and AG Grid keeps the cellRenderer a column was built with and only re-creates a cell when its row changes....
A deleted upload now falls back instead of going silent
The previous commit claimed a retired sound "degrades to the layer beneath it rather than to silence". It did not. `isKnownSoundId` accepts a custom id on shape...
48 unenforced — the six PLOS rights are gated now
Gating the LOS proxy made PLOS_* enforced, but they stayed on the unenforced list, so the editors were showing 'Not yet enforced' against six live gates. Third ...
Put the callback marker after the lead id
Leading the cell with the marker pushed the id right on any row with a call waiting, so the ids no longer lined up down the column while scrolling.
The meeting reminder reaches the bell, and pops once
MeetReminderPopup drew its own Snackbar from its own subscription to **************** Nothing else knew a reminder had happened: the bell stayed at zero, the de...
The meeting reminder is a notification, not a popup of its own
The sweep published a bespoke event on /topic/meet/reminder/{memberId} that a dedicated Snackbar drew in the corner of the screen. That popup was the entire rem...
One calendar reminder, announced once
A reminder was arriving twice. The deck picks it up as a notification, and the older path picked it up as well: CalendarWebSocketContext opened a second STOMP c...
A note is owned by a member, not by an account
Mirrors the API: NoteDTO now carries memberId in place of userId. A member is the signed-in account inside ONE organisation, so opening a different org shows a ...
Read and write notes as a member, never as an account
Every endpoint now requires memberID on the session — reads included — and refuses the request without one. The reads used to need only a userID, which is globa...
Scope notes to a membership instead of an account
A note hung off USER_ID alone and carried no organisation at all. A user is global and a member is that user inside one organisation, so an account belonging to...
Re-derive the audit structurally — 57 decorative
The count moved 58 -> 52 -> 47 -> 57 because every version hard-coded a list of gate-helper names and the codebase has more than anyone can recall. Six were mis...
Dock popup windows beside the page scrollbar, not on top of it
Tool windows are fixed to the viewport and dock right-to-left from its edge, and the layout was told about exactly one thing occupying that edge: the interactio...
Enforce the doc-share search rights server-side
/members-subscribers and /team-members-contractors enumerate the organisation's people — names and ids — to fill the document-share autocomplete, and required o...
Enforce the doc-share alias rights server-side
GET /shares/resolve-alias turns a guessable alias into a real person's NAME and required only a valid session. The rule lived solely in ShareDocumentDialog, and...
Stop the reminder lurching to the screen edge when an option opens
The card kept framer's `layout` after it grew a fold-out options panel. `layout` animates size and position by transform, so that one height change was being an...
47 unenforced — five more were falsely reported
CREATE_ORG_CALENDAR_EVENTS is enforced: MemberCalendarService throws OrgCalendarForbiddenException when a member without it writes to the org calendar. The chec...
52 unenforced, not 58 — six were falsely reported
The audit's gate detection recognised hasRight and checkRight but not denyUnless, hasAnyRight, sessionHasRight or forbidden. Six rights that ARE enforced were t...
Make the emoji picker's search actually filter
The picker's search matched the query against the translated category name only, and fell back to pushing every emoji into the results when nothing matched — so...
Sticky scrollbars, a toolbar that never scrolls, and a dialog that clears the note
Three things, all in the floating sticky. The scrollbar was still grey. The rules were written as **************** which styles only the element CARRYING the c...
Stop the launchpad backdrop painting over the page scrollbar
The launchpad is the only page that renders the full-bleed Backdrop, and it was the only page whose scrollbar stayed invisible after the -webkit-/standard confl...
The sticky's watermark is centred from the moment it opens
It only landed correctly after the note was resized. The measurement used getBoundingClientRect, which reports the PAINTED box — and a sticky opens by animating...
Centre the sticky's watermark on the writing surface
It was centred on the whole note, so it sat high — pulled up behind the title bar — and in rich mode it drifted further every time the toolbar wrapped to a seco...
Writing the org legal settings needs BOTH HR rights
The Legal & Compliance settings tab is the only writer and is now offered only to a member holding MANAGE_HRS_SETTINGS *and* MANAGE_LEGAL_AND_COMPLIANCE, so the...
The floating sticky's pin is the same pin /notes draws
The sticky was drawing a hand-rolled bookmark path while the notes wall, the editor, the rail and the bulk bar had all moved to MUI's PushPin — outlined when lo...
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.