Module class_security 

enforceRoleSecurity: the classes a client may not address at all.

This lives in the pipeline crate rather than in a route handler, and the layer is the point. Upstream calls it from both rest.js entry points and from the RestQuery constructor (RestQuery.js:54), and the include path builds a RestQuery (RestQuery.js:1250-1258), so an included read is checked too. A router-level copy is checked on the request a client sent and not on the reads that request fans out into, which is the same defect the _Session narrowing had.

Functions

enforce_class_security

Classes a client may not address, reproduced from enforceRoleSecurity (SharedRest.js:14-55).