Enforce run ownership and show owner info #74

Merged

TheFurya merged 6 commits from feature/enforce-run-ownership-on-all-mutation-endpoints into develop 2026-03-22 09:16:59 +01:00

Conversation 0 Commits 6 Files Changed 18

+1384 -140

6 Commits

Author	SHA1	Message	Date
TheFurya	38b1156a95	Merge branch 'develop' into feature/enforce-run-ownership-on-all-mutation-endpoints	2026-03-22 09:16:36 +01:00
TheFurya	596393d5b8	Merge pull request 'Infer genlocke visibility from first leg's run' (#77) from feature/infer-genlocke-visibility-from-first-legs-run into feature/enforce-run-ownership-on-all-mutation-endpoints ... Reviewed-on: #77	2026-03-22 09:15:16 +01:00
TheFuryaandClaude Opus 4.6	a4fa5bf1e4	feat: infer genlocke visibility from first leg's run ... Genlockes now inherit visibility from their first leg's run: - Private runs make genlockes hidden from public listings - All genlocke read endpoints now accept optional auth - Returns 404 for private genlockes to non-owners Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-21 13:47:05 +01:00
TheFuryaandClaude Opus 4.6	a3f332f82b	feat: show owner info in admin pages ... - Add Owner column to AdminRuns.tsx and AdminGenlockes.tsx - Add owner filter dropdown to both admin pages - Add owner field to GenlockeListItem schema (resolved from first leg's run) - Update frontend types for GenlockeListItem Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-21 13:38:08 +01:00
TheFuryaandClaude Opus 4.6	3bd24fcdb0	fix: hide edit controls for non-owners in frontend ... - Add useAuth and canEdit logic to RunEncounters.tsx - Guard all mutation triggers (Log Shiny, Log Egg, End Run, Randomize All, HoF Edit, Boss Battle, route/team clicks, Advance to Next Leg) - Update RunDashboard.tsx canEdit to be isOwner only (no unowned fallback) - Add read-only banner for non-owner viewers in both pages Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-21 13:33:04 +01:00
TheFuryaandClaude Opus 4.5	eeb1609452	fix: enforce run ownership on all mutation endpoints ... Add require_run_owner helper in auth.py that enforces ownership on mutation endpoints. Unowned (legacy) runs are now read-only. Applied ownership checks to: - All 4 encounter mutation endpoints - Both boss result mutation endpoints - Run update/delete endpoints - All 5 genlocke mutation endpoints (via first leg's run owner) Also sets owner_id on run creation in genlockes.py (create_genlocke, advance_leg) and adds 22 comprehensive ownership enforcement tests. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-03-21 13:28:47 +01:00