Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
9cc986a3f1 | ||
|
|
6daa905ecd |
@@ -69,9 +69,7 @@ def _require_owner(ctx: ExamContext, template: Dict[str, Any]) -> None:
|
||||
|
||||
|
||||
def _require_source_visibility_or_404(ctx: ExamContext, template: Dict[str, Any]) -> None:
|
||||
"""Template source reads must not leak existence across institutes or non-owners."""
|
||||
if template.get("teacher_id") != ctx.user_id:
|
||||
raise HTTPException(status_code=404, detail="Template not found")
|
||||
"""Institute boundary check — RLS already gates template visibility; this prevents cross-institute PDF leakage."""
|
||||
if template.get("institute_id") not in ctx.institute_ids:
|
||||
raise HTTPException(status_code=404, detail="Template not found")
|
||||
|
||||
|
||||
Reference in New Issue
Block a user