John Cardinal
2b1adaa496
Customer contacts had the Customer role's Select and read rights on most record types and could call any route whose staff role check they passed, including several with no role check (security review F13 to F17). Step 1 of 4712: the token middleware now answers 403 (same body as other 403s) to Customer and HeadOffice users for any route not in CustomerContactRoutes, the routes the customer screens use (read from raven-client). Anonymous routes are always allowed. New routes stay closed to contacts unless added on purpose. Ownership of the records these routes return follows in the next steps. Checked: full integration suite 103 passed, 5 skipped, the same 2 known failures as the baseline. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>