mirror of
https://github.com/hcengineering/platform.git
synced 2026-09-30 13:35:04 +02:00
Ignat RemizovandGitHub
f4f3d30bf1
Enforce contact edit boundaries for regular users on both the UI and transaction middleware so users can maintain their own profile details without being able to change other employees' person records or communication channels. Changes: - Reject regular-user CUD transactions that update another employee Person or channels attached to that employee, including nested TxApplyIf payloads. - Allow regular users to edit their own contact details and non-employee contacts, while Maintainers and Owners continue to manage employee records. - Share contact editability logic in contact resources and use it in person editing, channel editors, and channel presenters so the UI hides or disables blocked actions. - Add middleware tests covering own-person edits, blocked cross-employee person/channel edits, and maintainer bypass behavior. Validation: - git diff --check - rushx svelte-check in plugins/contact-resources - targeted Rush tests for @hcengineering/middleware and @hcengineering/contact-resources - targeted Rush build for @hcengineering/middleware and @hcengineering/contact-resources Behavioral effect: Regular users can update their own profile contact details, but attempts to edit another employee's person record or attached email, phone, or GitHub channels are blocked even if sent directly to the server.