1 Commits

Include renames

Author	SHA1	Message	Date
weichenandCursor	cc394c815c	fix(api): require project membership before chat and chat SSE ... Unrestricted stage access on projects without a live workflow must not let arbitrary authenticated users join by project_id. Enforce member or creator (admin per existing policy) before stage ABAC, and reject chat streams with JSON 403 before SSE headers/flush. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-13 12:25:22 +00:00