a2nr
/
velxio
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(autosave): only project owner triggers auto-save 

Without an ownership check, viewing someone else's project (admin
inspection, browsing public projects) caused the auto-save hook to
PUT the project on every store change. The backend correctly rejects
non-owner updates with 403, but the frontend surfaced these as
"save fail" to the user — misleading and noisy in logs.

The hook now stays idle unless the authenticated user matches
currentProject.ownerUsername. Manual saves through SaveProjectModal
are unaffected.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
David Montero 2026-05-03 21:41:32 +02:00
parent 9cd5061732
commit 888cb5b92b
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
frontend/src/hooks/useAutoSaveProject.ts
View File

@ -112,7 +112,12 @@ export function useAutoSaveProject(): AutoSaveState {
const reset = () => {
const user = useAuthStore.getState().user;
const proj = useProjectStore.getState().currentProject;
const eligible = !!user && !!proj && UUID_RE.test(proj.id);
// Only the project owner can auto-save. Viewing someone else's project
// (admin inspection, browsing public projects) leaves the hook idle —
// the backend correctly rejects non-owner PUTs with 403, and surfacing
// those failures as "save fail" to the user is misleading.
const eligible =
!!user && !!proj && UUID_RE.test(proj.id) && user.username === proj.ownerUsername;
projectIdRef.current = eligible ? proj!.id : null;
// Take a snapshot of the freshly-loaded state — this is the baseline
// for dirty detection. Without this, the very first change would fire