fix(gateway): enforce task and mission ownership

2026-03-13 14:43:33 -05:00
parent 1f784a6a04
commit 684dbdc6a4
4 changed files with 155 additions and 9 deletions
--- a/apps/gateway/src/missions/missions.controller.ts
+++ b/apps/gateway/src/missions/missions.controller.ts
@@ -36,7 +36,10 @@ export class MissionsController {
  }

  @Post()
-  async create(@Body() dto: CreateMissionDto) {
+  async create(@Body() dto: CreateMissionDto, @CurrentUser() user: { id: string }) {
+    if (dto.projectId) {
+      await this.getOwnedProject(dto.projectId, user.id, 'Mission');
+    }
    return this.brain.missions.create({
      name: dto.name,
      description: dto.description,