When API key has changed origin, actions complete even if the performer does not have access to the reference item
Description
When API key has Performed origin changed, approvals from reference items not available to the performer are still retrieved without issues (GET method) and the other actions (POST, PATCH, DELETE methods) on such approvals do not throw any errors.
Expected behaviour:
-
An approval on a reference the performer cannot see is not included in the GET /approvals response.
-
Actions like create/archive/delete are not completed and the outcome is surfaced as an instance warning.
Ready to deploy
Add watchers
Details
Priority
Assignee
Michał Błaszczykowski
Reporter
Adam Lipiński
Labels
APIroadmap
Time tracking
2h 15m logged
More fields
Due date
None
Original estimate
None
Fix versions
None
Affects versions
None
Components
None