Files
actual/packages
Copilot fc89c74445 Fix authorization bypass allowing non-owners to delete shared budgets (#6338)
* Initial plan

* Add permission checks for budget deletion

- Server-side: Check if user is file owner or admin before allowing deletion
- Client-side: Hide "Delete from all devices" button for non-owners
- Add comprehensive tests for permission checking
- Non-owners see message that only owner can delete from server

Co-authored-by: MatissJanis <886567+MatissJanis@users.noreply.github.com>

* Add release notes for PR #6338

* Update VRT screenshots

Auto-generated by VRT workflow

PR: #6338

* Fix: Change unauthorized to forbidden in delete-user-file

Co-authored-by: matiss <matiss@mja.lv>

* Update VRT screenshots

Auto-generated by VRT workflow

PR: #6338

* Update VRT screenshots

Auto-generated by VRT workflow

PR: #6338

* Fix: Update error reason from 'unauthorized' to 'forbidden' in delete-user-file response

* Update VRT screenshot for date filter test case

* [autofix.ci] apply automated fixes

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: MatissJanis <886567+MatissJanis@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: matiss <matiss@mja.lv>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Matt Fiddaman <github@m.fiddaman.uk>
2025-12-30 23:25:46 +00:00
..
2025-12-30 16:53:22 +00:00