John Cardinal
d75c3eecea
Step 3 of 4712 (security review F14). The Customer role has change rights on service requests and nothing checked whose they were. For customer contacts: another customer's request is not found (read, update, delete); creating or moving a request to a customer the contact does not own is refused (403); a contact's request is always requested by that contact. unit/customerunit adds units only to the contact's own customer (or one of its head office's). Checked: another customer's request 404 (was 200), create for another customer 403, own request created and deleted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>