dextmorgn dd9caf2cb1 fix(api): enforce object-level authorization on Flow update/delete/read ...

Flow update, delete, and ID-based read never checked caller identity
against the target record, so any authenticated user could tamper with
or delete another user's Flow by UUID, and the list endpoint returned
every user's flows unfiltered. Added a nullable owner_id column (NULL
= pre-existing flows, readable by all but not editable via the API),
stamp it on create, and check ownership in FlowService before mutating
or returning a single Flow.

Fixes GHSA-qvx2-6v5v-wwrg.

2026-08-23 13:10:11 +02:00

..

__init__.py

…

test_enricher_template_service.py

…

test_template_generator_service.py

…

test_timezone_timestamps.py

fix(api): enforce object-level authorization on Flow update/delete/read

2026-08-23 13:10:11 +02:00