Protect owner invitation authority

2026-09-04 00:30:29 -04:00
parent d54d6a4ad1
commit 3fe1547a5b
10 changed files with 143 additions and 16 deletions
@@ -79,3 +79,9 @@ application concern belongs in the shared module.
  that invariant into the same SQLite transactions as direct-role and
  membership changes, while leaving the application's role vocabulary and UI
  policy application-owned.
+- Gamertan's invitation work found the same authority boundary before a route
+  was exposed: Site Admin must be able to invite ordinary staff without being
+  able to grant or cancel Owner access. Preview 20 passes the configured owner
+  role into invitation mutations and rechecks a current active direct Owner
+  after acquiring the SQLite write lock. The application still owns fresh
+  authentication, recipient delivery, and the one-time secret presentation.