发布

  • [NA] [BE] fix: enforce project visibility when resolving thread by project name (#7019)

    frostbyte_neo 发布于 2026-06-10 17:26:49 +00:00

    ProjectService.validateProjectIdentifier verified project visibility only on
    the project-id branch (via get(projectId)); the project-name branch returned
    the project without the check, so the two identifier forms behaved
    inconsistently for public-visibility requests.

    Apply the same verifyVisibility(...) on the project-name branch so both paths
    enforce visibility identically.

    Add regression tests for thread retrieval by project name across the API-key
    and session-token public-access matrices — previously only the project-id
    branch was covered, which is why the gap went unnoticed.

    下载附件