John Cardinal
ee59efff48
Users who may edit contacts but not users (Service, Sales, Accounting) could give a contact login any role, BizAdmin and OpsAdmin included, and roles are what every check uses (security review F28). Now: - saving a Customer or HeadOffice user with any role other than Customer or CustomerRestricted is refused (error on Roles); - UserBiz.EffectiveRoles masks a contact's roles to the customer roles wherever they are applied: the token middleware, download-key routes, and the notification subscriber check, so contacts that already have staff roles stored act without them. Checked: Service creating a contact with BizAdmin refused, with Customer works; a contact with OpsAdmin stored in the database gets 403 downloading a log file. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>