Jason Woltje db35ba03b9 fix(gateway): filter projects by ownership — close data privacy leak ...

GET /api/projects now returns only projects owned by the requesting user
or belonging to teams the user is a member of, via a new findAllForUser()
method in the brain projects repo. GET/PATCH/DELETE single-project endpoints
now use canAccessProject() (handling both user and team ownership) instead
of the direct-owner-only assertOwner(). Fixes #197.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-16 21:34:56 -05:00

..

gateway

fix(gateway): filter projects by ownership — close data privacy leak

2026-03-16 21:34:56 -05:00

web

fix(web): add jsdom dependency and exclude e2e from vitest (#155)

2026-03-15 20:00:53 +00:00