John O'Keefe
aa9bd950f9
fix(collections): gate the chain-order endpoint by ownership
...
PUT /api/collections/:id/view-settings writes the row; it now demands
UserOwnsCollection like its sibling config mutations (SetMatchMode,
ReorderItems) — otherwise any signed-in user could flip another
user's curated listening order. Discovered while documenting the
endpoint: the sibling pattern exists precisely because the main
PUT/DELETE routes lack it (their gap is noted for follow-up, not
expanded here).
2026-10-31 15:40:21 -04:00
..
2026-02-14 21:38:08 -05:00
2026-10-29 09:27:04 -04:00
2026-08-22 13:16:43 -04:00
2026-02-14 21:38:08 -05:00
2026-10-27 14:05:36 -04:00
2026-10-25 11:06:08 -04:00
2026-10-30 17:25:22 -04:00
2026-10-31 13:39:24 -04:00
2026-03-06 14:00:28 -05:00
2026-10-30 19:38:39 -04:00
2026-10-31 15:40:21 -04:00
2026-10-25 11:06:26 -04:00
2026-04-20 20:43:04 -04:00
2026-10-29 10:14:08 -04:00
2026-03-06 14:00:28 -05:00
2026-10-17 16:36:58 -04:00
2026-10-19 15:25:40 -04:00
2026-10-25 11:06:08 -04:00
2026-10-29 11:57:20 -04:00
2026-04-21 21:15:59 -04:00
2026-10-17 17:15:14 -04:00
2026-10-29 09:27:04 -04:00
2026-02-14 21:38:08 -05:00
2026-10-25 11:06:08 -04:00
2026-09-09 09:04:23 -04:00
2026-10-25 11:06:08 -04:00
2026-02-14 21:38:08 -05:00
2026-10-25 11:06:08 -04:00
2026-10-25 11:06:08 -04:00
2026-10-25 12:08:26 -04:00
2026-10-30 14:57:08 -04:00
2026-07-30 12:12:51 -04:00
2026-10-29 15:44:48 -04:00
2026-10-29 16:03:35 -04:00
2026-10-30 14:06:54 -04:00
2026-10-27 13:22:31 -04:00
2026-10-16 17:28:06 -04:00
2026-10-29 09:27:04 -04:00
2026-10-17 11:45:05 -04:00
2026-10-25 11:06:08 -04:00
2026-02-14 21:38:08 -05:00
2026-10-29 22:01:32 -04:00
2026-10-29 15:38:45 -04:00
2026-02-13 20:04:47 -05:00
2026-10-17 16:36:58 -04:00
2026-10-27 19:05:23 -04:00
2026-02-14 21:38:08 -05:00
2026-10-28 00:22:00 -04:00
2026-10-16 10:20:17 -04:00
2026-10-30 10:12:43 -04:00
2026-08-06 13:02:35 -04:00
2026-10-29 09:27:04 -04:00