Review fix: parent-tombstone gate in ensureDocAccess owner path; tr role=link
Independent review of PR #57 (REQUEST_CHANGES, one should-fix):
- ensureDocAccess returned {ok:true} for the document owner BEFORE reaching
checkProjectAccess, so the folded-in parent-tombstone gate only fired on the
non-owner path. A doc owner (or a firm colleague who uploaded a doc into
someone else's tombstoned firm matter) could still GET/download it for the
retention window. Added the parent-matter tombstone check before the owner
short-circuit (mirrors ensureReviewAccess); standalone docs (project_id null)
unaffected. 42703-tolerant. +2 tests.
- NIT: firm-library <tr> role="button" -> role="link" (navigation semantics;
keeps tabIndex/handlers/focus style).
Backend 513/513, tsc clean. Frontend tsc/eslint clean.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
| Repository | Sloth-ninja/JessicaOSS |
|---|---|
| Author | sloth-ninja <ezanahaddis@gmail.com> |
| Authored | |
| Parents | cee6bc61 |
| Stats | 4 files changed , +63 , -2 |
| Part of | WS9: firm library and firm-level visibility |
Capture this commit into my fork
Download a Markdown prompt that tells Claude how to port this
exact commit into your working tree. Run it via
claude -p < capture-commit-d21d6d7a.md
from inside the repo you want the change in.