diff --git a/routers/exam/templates.py b/routers/exam/templates.py index 34f1436..c707ba3 100644 --- a/routers/exam/templates.py +++ b/routers/exam/templates.py @@ -69,9 +69,7 @@ def _require_owner(ctx: ExamContext, template: Dict[str, Any]) -> None: def _require_source_visibility_or_404(ctx: ExamContext, template: Dict[str, Any]) -> None: - """Template source reads must not leak existence across institutes or non-owners.""" - if template.get("teacher_id") != ctx.user_id: - raise HTTPException(status_code=404, detail="Template not found") + """Institute boundary check — RLS already gates template visibility; this prevents cross-institute PDF leakage.""" if template.get("institute_id") not in ctx.institute_ids: raise HTTPException(status_code=404, detail="Template not found")