content: custody visibility reaches detail pages and the Companion app - #247
content: custody visibility reaches detail pages and the Companion app#247carlosvirreira wants to merge 1 commit into
Conversation
Triggered by shelf.nu #2852, the follow-up to #2840. Documents that the custody visibility setting now covers asset and kit detail pages, three Companion endpoints, booking-derived custodians on checked-out items, and the quantity-custody picker seed — and that a person's own custody stays visible throughout.
|
Warning Review limit reached
Next review available in: 54 minutes Limit details: You’ve used all 1 included review currently available under your plan. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Preview deployment |
1 participant
Triggered by
Follow-up to #2840, which website-v2#242 already documented.
Product change summary
The custody visibility setting held on the index and the select-all query paths after #2840. #2852 extends it to the surfaces that were left: asset and kit detail pages, three Companion endpoints (asset list, kit list, kit detail), the custodian shown for an item that is out on a booking, and the seed for the quantity-tracked custody picker. A viewer's own custody stays visible throughout — the redaction hides other people, never the item in the viewer's own hands.
For an end user of an affected workspace this is visible: a Self-service or Base user who could previously read a colleague's name by opening an asset page or the mobile app now sees the same Private treatment the list already gave them.
Content changes
Content enhancements
content/knowledge-base/configure-what-self-service-and-base-users-can-see.mdx— the What the Toggles Never Reach section described the restriction as reaching lists, filters, select-all and QR downloads, which was as far as it went. Three bullets added: it now reaches detail pages and the Companion app, it covers the booking custodian shown on checked-out gear, and a person's own custody is never hidden on any of them.New content
content/updates/custody-visibility-reaches-every-surface.mdx— changelog entry. This one is worth publishing rather than folding into the KB silently: admins running a workspace with the setting off will see their Self-service and Base users lose access to names they previously could read on a detail page or in the app, and they should hear that from/updatesrather than from a confused user.Review notes
Written forward-looking — what the setting covers today — rather than as a list of what used to leak. The framing is deliberate: these were pre-existing gaps on
mainrather than regressions, and a public page is not the place to enumerate what was readable before.One item from #2852 is deliberately not on the page. The PR notes that
custody[].teamMemberIdremains in redacted payloads: no name, no email, but a stable identifier. It is called out in the PR as a decision rather than an oversight, and it is below the level of detail a help article should carry.The claim that the picker "now offers the same people the search behind it already offered" is the
resolveCustodianPickerScope({ purpose: "custody-assignment" })change, stated as the user-visible consequence rather than as the internal fix.node scripts/check-product-claims.mjspasses across 547 files.Impact scope
Generated by Shelf Content Intelligence — PR→Website Sync