fix(controller): filter listing endpoints by ownership

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
2026-09-19 17:50:12 +00:00 · 2026-05-17 10:24:19 +08:00
parent a5995ce045
commit acc2b63ce2
2 changed files with 10 additions and 3 deletions
@@ -39,8 +39,12 @@ func listNotificationGroup(c *gin.Context) ([]*model.NotificationGroupResponseIt
 		groupNotifications[n.NotificationGroupID] = append(groupNotifications[n.NotificationGroupID], n.NotificationID)
 	}

+	isAdmin := callerIsAdmin(c)
 	ngRes := make([]*model.NotificationGroupResponseItem, 0, len(ng))
 	for _, n := range ng {
+		if !isAdmin && !n.HasPermission(c) {
+			continue
+		}
 		ngRes = append(ngRes, &model.NotificationGroupResponseItem{
 			Group:         n,
 			Notifications: groupNotifications[n.ID],