GovOPlaN/govoplan-addresses
1
0
Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(addresses): require group visibility for book creation

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-20 17:03:58 +02:00
parent f19350e65d
commit 3d52cc86f9
2 changed files with 34 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/govoplan_addresses/backend/service.py
View File

@@ -175,7 +175,7 @@ def _scope_id_for_create(principal: ApiPrincipal, payload: AddressBookCreateRequ
group_id = _trim(payload.group_id)
if not group_id:
raise AddressBookError("Group address books require a group id.")
if principal.group_ids and group_id not in principal.group_ids and not principal.has("addresses:address_book:admin"):
if group_id not in principal.group_ids and not principal.has("addresses:address_book:admin"):
raise AddressBookError("The selected group is not visible to the current principal.")
return tenant_id, group_id
raise AddressBookError("Unsupported address book scope.")