Require review owner for tabular settings edits
From the PR description
Summary
- require tabular review ownership before changing the review title
- require tabular review ownership before changing the review document list
- keep existing owner-only checks for columns, sharing, and project moves unchanged
Bug
PATCH /tabular-review/:reviewId already restricted columns, sharing, and project moves to the review owner, but it allowed any user with review access to change title or document_ids. That let collaborators rename another user's review or add/remove documents and cells by calling the API directly, even though the UI treats these as owner-controlled structural settings.
Verification
- npm run build --prefix backend
Our analysis
Restrict tabular review title and document-list edits to the review owner — read the full analysis →
Think the analysis missed something the PR description covers?
Capture this PR into my fork
Download a Markdown prompt that tells Claude how to port every
commit in this PR into your working tree. Run it via
claude -p < capture-pull-175.md from
inside the repo you want the changes in.