Darko Gjorgjijoski d3202b8b2a fix(members): scope member view & update to the acting company ...

Member view/update bound the target user by global id and authorized only that the requester owns their active company, not that the target belonged to it. Bind the route model under the members param and require shared company membership in UserPolicy so an owner of one company can no longer read or modify users of another.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-14 23:42:11 +02:00

2.9 KiB

Raw Blame History

View Raw