mirror of
https://github.com/Hestia-Homes/assessment-model.git
synced 2026-07-27 22:45:03 +00:00
45ba4e9d6d
The settings hub (#444) needs a write path for the project-details form. This is that path, and nothing else — the hub page itself follows. `updateProjectSchema` is *derived* from #409's `createProjectSchema` rather than restated: same fields, same messages, same date rule (now a shared exported predicate, so the two cannot drift). The one difference is deliberate — the owning organisation is not editable. Every role on a project is derived from `project.organisation_id`, so re-homing one is a re-permissioning act, not a detail edit; it is absent from the schema and absent from the update statement. Authorization asks the existing rule twice. First, may this user manage this project (404 if they cannot even view it, so existence stays private; an honest 403 for a contractor who already knows it exists). Second, would they still manage it *afterwards* — un-ticking `domna_admin_access` revokes the internal role, so an internal non-member could otherwise save an edit that locks them out with no way back. That is the same guard POST /api/projects applies to creation, via the mirror of its `prospectiveProjectFacts`. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| app | ||
| lib | ||
| types | ||
| utils | ||
| middleware.test.ts | ||
| middleware.ts | ||