dd43b88fff
Address the review findings that blocked collaboration and hardened tenancy: - Ownership validation and the view/budget/real-estate policies scope by the active space instead of user_id, so a member can open detail pages and create or edit data in a shared space (previously 422/403). - Authorize purely on live space membership, dropping the current_space_id shortcut, and reset a removed member's pointer to their personal space so no stale-pointer write window remains. - Apply automation rules per space, so a multi-space owner's personal-space rules never categorise a business-space transaction. - Flush the offline cursor before the rows on space switch to avoid a stale re-sync. Adds member-access tests. |
||
|---|---|---|
| .. | ||
| css | ||
| js | ||
| views | ||