apiVersion: jenkins.io/v1 kind: PipelineActivity metadata: annotations: lighthouse.jenkins-x.io/cloneURI: https://github.com/hgngenterprises/riders.git lighthouse.jenkins-x.io/job: release pipeline.jenkins-x.io/traceID: 4cbdf1377f45d58013936fcf7e6a5b4b creationTimestamp: "2026-09-06T14:51:31Z" generation: 8 labels: branch: main build: "27" context: release created-by-lighthouse: "true" event-GUID: 70143dd0-aa02-11f1-9646-ab68b2bcd5ec lighthouse.jenkins-x.io/baseSHA: e69b58a527145fa2e58e103056bb979313d37198 lighthouse.jenkins-x.io/branch: main lighthouse.jenkins-x.io/buildNum: "1788706290987" lighthouse.jenkins-x.io/context: release lighthouse.jenkins-x.io/id: genterprises-riders-main-release-wfgld lighthouse.jenkins-x.io/job: release lighthouse.jenkins-x.io/lastCommitSHA: e69b58a527145fa2e58e103056bb979313d37198 lighthouse.jenkins-x.io/refs.org: hgngenterprises lighthouse.jenkins-x.io/refs.repo: riders lighthouse.jenkins-x.io/type: postsubmit owner: hgngenterprises podName: genterprises-riders-main-release-6jk7s-from-build-pack-pod provider: github repository: riders tekton.dev/pipeline: genterprises-riders-main-release managedFields: - apiVersion: jenkins.io/v1 fieldsType: FieldsV1 fieldsV1: f:metadata: f:labels: f:branch: {} f:context: {} f:owner: {} f:provider: {} f:repository: {} f:spec: f:lastCommitMessage: {} f:lastCommitSHA: {} f:releaseNotesURL: {} f:version: {} manager: jx-changelog-0.10.29 operation: Update time: "2026-09-06T14:55:36Z" - apiVersion: jenkins.io/v1 fieldsType: FieldsV1 fieldsV1: f:metadata: f:annotations: .: {} f:lighthouse.jenkins-x.io/cloneURI: {} f:lighthouse.jenkins-x.io/job: {} f:pipeline.jenkins-x.io/traceID: {} f:labels: .: {} f:build: {} f:created-by-lighthouse: {} f:event-GUID: {} f:lighthouse.jenkins-x.io/baseSHA: {} f:lighthouse.jenkins-x.io/branch: {} f:lighthouse.jenkins-x.io/buildNum: {} f:lighthouse.jenkins-x.io/context: {} f:lighthouse.jenkins-x.io/id: {} f:lighthouse.jenkins-x.io/job: {} f:lighthouse.jenkins-x.io/lastCommitSHA: {} f:lighthouse.jenkins-x.io/refs.org: {} f:lighthouse.jenkins-x.io/refs.repo: {} f:lighthouse.jenkins-x.io/type: {} f:podName: {} f:tekton.dev/pipeline: {} f:spec: .: {} f:baseSHA: {} f:batchPipelineActivity: {} f:build: {} f:buildLogsUrl: {} f:completedTimestamp: {} f:context: {} f:gitBranch: {} f:gitOwner: {} f:gitRepository: {} f:gitUrl: {} f:message: {} f:pipeline: {} f:startedTimestamp: {} f:status: {} f:steps: {} manager: jx-build-controller operation: Update time: "2026-09-06T14:58:03Z" name: hgngenterprises-riders-main-27 namespace: jx resourceVersion: "328204656" uid: 3ab64a4c-e4c6-4174-bee2-88564e84f1a6 spec: baseSHA: e69b58a527145fa2e58e103056bb979313d37198 batchPipelineActivity: {} build: "27" buildLogsUrl: s3://logs-gct-prod-20260425045301534100000007/jenkins-x/logs/hgngenterprises/riders/main/27.log completedTimestamp: "2026-09-06T14:57:56Z" context: release gitBranch: main gitOwner: hgngenterprises gitRepository: riders gitUrl: https://github.com/hgngenterprises/riders.git lastCommitMessage: | fix: admit managers by role, and refuse requests with no identity Two defects in one domain. **Managers were locked out.** Access required you to be a Rider or to have a *direct* Rider report. A Senior Team Lead whose reports are Team Leads was refused, so Neeraj Kumar could not open the app at all -- and archiving someone's last rider silently locked their manager out the same way. Access now follows the job (Rider, Team Lead, Senior Team Lead) rather than the shape of the tree below you, which is also what routes/employees.js already assumes when it derives the role. **No identity returned somebody's data.** With no x-gct-user-id the domain became `work_contact_id.ref = false`, which matches employees whose partner has no ref -- so an unauthenticated caller was handed a real operator's name, profile, wallet balance and dues. Verified against production before the fix: a request with no header returned employee 785 in full. Missing identity is now refused before anything reaches Bifrost, because the danger is the query, not the response. Co-Authored-By: Claude Opus 5 (1M context) lastCommitSHA: adf77b4bce74fc1b23096d96e25d27d2754f26af message: 'Tasks Completed: 1 (Failed: 0, Cancelled 0), Skipped: 0' pipeline: hgngenterprises/riders/main releaseNotesURL: https://github.com/hgngenterprises/riders/releases/tag/v0.27.21 startedTimestamp: "2026-09-06T14:51:31Z" status: Succeeded steps: - kind: Stage stage: completedTimestamp: "2026-09-06T14:57:56Z" name: from build pack startedTimestamp: "2026-09-06T14:51:36Z" status: Succeeded steps: - completedTimestamp: "2026-09-06T14:52:48Z" name: Git Clone startedTimestamp: "2026-09-06T14:51:36Z" status: Succeeded - completedTimestamp: "2026-09-06T14:52:52Z" name: Next Version startedTimestamp: "2026-09-06T14:52:49Z" status: Succeeded - completedTimestamp: "2026-09-06T14:52:57Z" name: Jx Variables startedTimestamp: "2026-09-06T14:52:52Z" status: Succeeded - completedTimestamp: "2026-09-06T14:54:00Z" name: Build Npm Install startedTimestamp: "2026-09-06T14:52:58Z" status: Succeeded - completedTimestamp: "2026-09-06T14:55:27Z" name: Build Container Build startedTimestamp: "2026-09-06T14:54:01Z" status: Succeeded - completedTimestamp: "2026-09-06T14:55:36Z" name: Promote Changelog startedTimestamp: "2026-09-06T14:55:27Z" status: Succeeded - completedTimestamp: "2026-09-06T14:55:42Z" name: Promote Helm Release startedTimestamp: "2026-09-06T14:55:37Z" status: Succeeded - completedTimestamp: "2026-09-06T14:57:56Z" name: Promote Jx Promote startedTimestamp: "2026-09-06T14:55:42Z" status: Succeeded - kind: Promote promote: environment: staging pullRequest: pullRequestURL: https://github.com/greencapitaltrade/mcu/pull/5680 startedTimestamp: "2026-09-06T14:57:08Z" status: Succeeded startedTimestamp: "2026-09-06T14:57:08Z" status: Succeeded - kind: Promote promote: environment: production pullRequest: pullRequestURL: https://github.com/greencapitaltrade/mcu/pull/5681 startedTimestamp: "2026-09-06T14:57:53Z" status: Succeeded startedTimestamp: "2026-09-06T14:57:53Z" status: Succeeded version: 0.27.21 status: {}