feat: tenant isolation Phase 0 — app-layer filters, UUID audit, CI gate #132
@@ -47,10 +47,10 @@ async def get_step_or_404(
|
|||||||
raise HTTPException(status_code=404, detail="Step not found")
|
raise HTTPException(status_code=404, detail="Step not found")
|
||||||
|
|
||||||
if check_view and not can_view_step(current_user, step):
|
if check_view and not can_view_step(current_user, step):
|
||||||
raise HTTPException(status_code=403, detail="Not authorized to view this step")
|
raise HTTPException(status_code=404, detail="Step not found")
|
||||||
|
|
||||||
if check_edit and not can_edit_step(current_user, step):
|
if check_edit and not can_edit_step(current_user, step):
|
||||||
raise HTTPException(status_code=403, detail="Not authorized to modify this step")
|
raise HTTPException(status_code=404, detail="Step not found")
|
||||||
|
|
||||||
return step
|
return step
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user