UN-3739 [FIX] Prompt Studio owner-access check validates requester, not just profile creator - #2183

Merged

athul-rs merged 6 commits into

mainfrom

fix/un-3739-owner-access

Jul 17, 2026

Commits on Jul 16, 2026

UN-3739 [FIX] Validate requester, not just profile creator, in owner-access check

athul-rs
and
claude
committed
5be7b43
UN-3739 [FIX] Pass the real requester from views — user_id is the file-path owner

athul-rs
and
claude
committed
fcf48ba
UN-3739 [FIX] Address review: no PII in denial messages, annotate request_user_id

athul-rs
and
claude
committed
9d33951

Commits on Jul 17, 2026

UN-3739 [FIX] Address review: pass request.user object, harden plumbing contract

athul-rs
and
claude
committed
153e4dc
Merge origin/main: adopt UN-2202 access bridges in owner-access guard

athul-rs
and
claude
committed
4c8bbe1
UN-3739 [FIX] Address review round 3: creator-requester message, summarize hop contract

athul-rs
and
claude
committed
ba313f4