Restrict project folder deletion to owners

This commit is contained in:
Lawyered 2026-06-27 20:16:08 -04:00
parent 93f921be90
commit 15f65f5315

View file

@ -783,6 +783,7 @@ projectsRouter.delete("/:projectId/folders/:folderId", requireAuth, async (req,
const access = await checkProjectAccess(projectId, userId, userEmail, db);
if (!access.ok) return void res.status(404).json({ detail: "Project not found" });
if (!access.isOwner) return void res.status(404).json({ detail: "Project not found" });
const { data: allFolders, error: foldersError } = await db
.from("project_subfolders")