From 15f65f53154a0d22ade1e8ea5cdd1490c55098cd Mon Sep 17 00:00:00 2001
From: Lawyered <ethlawyer1@gmail.com>
Date: Sat, 27 Jun 2026 20:16:08 -0400
Subject: [PATCH] Restrict project folder deletion to owners

---
 backend/src/routes/projects.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/backend/src/routes/projects.ts b/backend/src/routes/projects.ts
index 893e255b..187c5507 100644
--- a/backend/src/routes/projects.ts
+++ b/backend/src/routes/projects.ts
@@ -783,6 +783,7 @@ projectsRouter.delete("/:projectId/folders/:folderId", requireAuth, async (req,
 
   const access = await checkProjectAccess(projectId, userId, userEmail, db);
   if (!access.ok) return void res.status(404).json({ detail: "Project not found" });
+  if (!access.isOwner) return void res.status(404).json({ detail: "Project not found" });
 
   const { data: allFolders, error: foldersError } = await db
     .from("project_subfolders")