93e2d6823c
The categorization, bulk rule re-evaluation, and automation-rule apply status endpoints looked jobs up by a bare job UUID. Any authenticated user who obtained another user's job id could poll its progress payload. Include the owning user's id in the cache key so a status request keyed by the polling user's id can only resolve that user's own jobs; a mismatched owner now falls through to the existing 404. No ownership store or extra lookup needed. Added cross-user isolation tests for all three endpoints. |
||
|---|---|---|
| .. | ||
| Controllers | ||
| Middleware | ||
| Requests | ||
| Responses | ||