pastilhasandClaude Opus 5
d8ee678ec4
signin refused any non-owner arriving through the web or mobile platform origin: "This account can only sign in through its app." so a member could hold a gitea grant and still never reach a page — verified as a live 403 before this change. that rule was correct while single-user was the invariant. the only non-owner accounts were music-app accounts, and there was no way to say "this person may use the platform, but only these parts of it", so keeping them out entirely was the honest answer. capabilities say exactly that now, per feature, at both doors and on every request. so superAdminOnly is retired rather than patched. the web origin and the platform app get no path scoping — what their caller may reach is decided by their role, not by their Origin. per-app path scoping stays for the single-feature apps (music, vault, tail), where it still means something. note this WIDENS who may sign in: any Active account can now authenticate through the browser. that is the intended product change, and it is only safe because the capability backstop runs on every request behind it — which is why it lands after that, not before. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>