feat: tenant isolation Phase 0 — app-layer filters, UUID audit, CI gate #132
@@ -47,10 +47,10 @@ async def get_step_or_404(
|
||||
raise HTTPException(status_code=404, detail="Step not found")
|
||||
|
||||
if check_view and not can_view_step(current_user, step):
|
||||
raise HTTPException(status_code=403, detail="Not authorized to view this step")
|
||||
raise HTTPException(status_code=404, detail="Step not found")
|
||||
|
||||
if check_edit and not can_edit_step(current_user, step):
|
||||
raise HTTPException(status_code=403, detail="Not authorized to modify this step")
|
||||
raise HTTPException(status_code=404, detail="Step not found")
|
||||
|
||||
return step
|
||||
|
||||
|
||||
Reference in New Issue
Block a user