13 commits

Author	SHA1	Message	Date
Timothy Jaeryang Baek	de3317e26b	refac	2026-03-17 17:58:01 -05:00
Timothy Jaeryang Baek	c85afce702	fix: import ... Co-Authored-By: Steven Schveighoffer <580778+schveiguy@users.noreply.github.com>	2026-03-06 14:10:50 -06:00
Timothy Jaeryang Baek	345f3e3559	refac	2026-02-25 15:15:59 -06:00
Timothy Jaeryang Baek	176f9a7816	refac	2026-02-23 16:01:03 -06:00
Timothy Jaeryang Baek	3d99de6771	enh: access grant level perms	2026-02-23 15:49:05 -06:00
Timothy Jaeryang Baek	626d236d13	chore: format	2026-02-13 15:00:39 -06:00
Timothy Jaeryang Baek	df6e38039f	refac	2026-02-13 13:29:22 -06:00
Classic298	73776d54b8	fix: enforce public sharing permission checks across all resource types (#21358) ... The sharePublic prop in editor components (Knowledge, Tools, Skills, Prompts, Models) incorrectly included an "|| edit" / "|| write_access" condition, allowing users with write access to see and use the "Public" sharing option regardless of their actual public sharing permission. Additionally, all backend access/update endpoints only verified write authorization but did not check the corresponding sharing.public_* permission, allowing direct API calls to bypass frontend restrictions entirely. Frontend: removed the edit/write_access bypass from sharePublic in all five editor components so visibility is gated solely by the user's sharing.public_* permission or admin role. Backend: added has_public_read_access_grant checks to the access/update endpoints in knowledge.py, tools.py, prompts.py, skills.py, models.py, and notes.py. Public grants are silently stripped when the user lacks the corresponding permission. Fixes #21356	2026-02-13 11:22:32 -06:00
Timothy Jaeryang Baek	f376d4f378	chore: format	2026-02-11 16:24:11 -06:00
Timothy Jaeryang Baek	c8cbdc8f7f	refac	2026-02-11 15:24:12 -06:00
Timothy Jaeryang Baek	64c37ab968	refac	2026-02-11 15:12:37 -06:00
Timothy Jaeryang Baek	a38ad8fc42	refac	2026-02-11 14:09:55 -06:00
Timothy Jaeryang Baek	c2207887b3	feat: skills backend	2026-02-11 14:00:34 -06:00