All 8 glossary route handlers now verify the requesting user has org membership in the target client_id using assert_user_in_org() from core/authz.py. Read endpoints require VIEWER, mutations require MANAGER, archive requires ADMIN (org-level). Removed dead _assert_can_read() and _require_client_staff() helpers. Removed unused require_roles/User/UserRole imports. Also added get_job_or_403() to authz.py for MT-15. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| v1 | ||