Restrict rendered template artifacts

src/govoplan_templates/backend/rendering.py

@@ -31,6 +31,7 @@ from govoplan_templates.backend.db.models import (
     TemplateRevision,
 )
 from govoplan_templates.backend.service import (
+    ADMIN_SCOPE,
     RENDER_SCOPE,
     compatibility,
     get_template,
@@ -199,6 +200,14 @@ def get_render_for_principal(
     if row is None:
         raise TemplateRenderError("Template render not found.")
     get_template(session, principal, row.template_id)
+    if (
+        row.created_by_account_id != principal.account_id
+        and not principal.has(ADMIN_SCOPE)
+    ):
+        # Render payloads may contain recipient-specific or otherwise
+        # confidential data. Do not reveal whether another actor's render
+        # exists to ordinary template readers.
+        raise TemplateRenderError("Template render not found.")
     return row
 
 
@@ -212,6 +221,10 @@ def list_renders(
     statement = select(TemplateRender).where(
         TemplateRender.tenant_id == principal.tenant_id
     )
+    if not principal.has(ADMIN_SCOPE):
+        statement = statement.where(
+            TemplateRender.created_by_account_id == principal.account_id
+        )
     if template_id:
         get_template(session, principal, template_id)
         statement = statement.where(TemplateRender.template_id == template_id)