fix(gateway): filter projects by ownership — close data privacy leak #202

Merged

jason.woltje merged 1 commits from fix/projects-ownership-filter into main 2026-03-17 02:35:46 +00:00

Conversation 0 Commits 1 Files Changed 5

+132 -11

jason.woltje commented 2026-03-17 02:35:31 +00:00

Owner

Copy Link

Copy Source

GET /api/projects now returns only projects owned by the requesting user or belonging to their teams. Fixes #197.

GET /api/projects now returns only projects owned by the requesting user or belonging to their teams. Fixes #197.

jason.woltje added 1 commit 2026-03-17 02:35:31 +00:00

fix(gateway): filter projects by ownership — close data privacy leak ... db35ba03b9

GET /api/projects now returns only projects owned by the requesting user
or belonging to teams the user is a member of, via a new findAllForUser()
method in the brain projects repo. GET/PATCH/DELETE single-project endpoints
now use canAccessProject() (handling both user and team ownership) instead
of the direct-owner-only assertOwner(). Fixes #197.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

jason.woltje merged commit 93645295d5 into main 2026-03-17 02:35:46 +00:00

jason.woltje referenced this issue from a commit 2026-03-17 02:35:47 +00:00

fix(gateway): filter projects by ownership — close data privacy leak (#202)

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

fleet-enhancement

Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

jason.woltje

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#202