Files
Stirling-PDF/app
EthanHealy01 b22a71de0a Scope ADMINS_AND_TEAM_LEADS default access to the owning team
matchesDefault answered 'is this user a leader of ANY team' without looking
at which team owns the resource, so once a real TeamLeadLookup is wired a
leader of one team could use (read) another team's resource shared at that
level. Thread the owning team id through canUseResource and require
leadership of THAT team; resources with no owning team (portal /
server-scoped) keep admitting any lead, which is the intended semantic
there. Dormant today: the only TeamLeadLookup is the always-false no-op.
2026-07-06 15:45:16 +01:00
..