From 888cb5b92be824e78cdfdc014ff6fba562f17928 Mon Sep 17 00:00:00 2001 From: David Montero Date: Sun, 3 May 2026 21:41:32 +0200 Subject: [PATCH] fix(autosave): only project owner triggers auto-save MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Without an ownership check, viewing someone else's project (admin inspection, browsing public projects) caused the auto-save hook to PUT the project on every store change. The backend correctly rejects non-owner updates with 403, but the frontend surfaced these as "save fail" to the user — misleading and noisy in logs. The hook now stays idle unless the authenticated user matches currentProject.ownerUsername. Manual saves through SaveProjectModal are unaffected. Co-Authored-By: Claude Opus 4.7 (1M context) --- frontend/src/hooks/useAutoSaveProject.ts | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/frontend/src/hooks/useAutoSaveProject.ts b/frontend/src/hooks/useAutoSaveProject.ts index bfdf5d7b..4e4ba9c9 100644 --- a/frontend/src/hooks/useAutoSaveProject.ts +++ b/frontend/src/hooks/useAutoSaveProject.ts @@ -112,7 +112,12 @@ export function useAutoSaveProject(): AutoSaveState { const reset = () => { const user = useAuthStore.getState().user; const proj = useProjectStore.getState().currentProject; - const eligible = !!user && !!proj && UUID_RE.test(proj.id); + // Only the project owner can auto-save. Viewing someone else's project + // (admin inspection, browsing public projects) leaves the hook idle — + // the backend correctly rejects non-owner PUTs with 403, and surfacing + // those failures as "save fail" to the user is misleading. + const eligible = + !!user && !!proj && UUID_RE.test(proj.id) && user.username === proj.ownerUsername; projectIdRef.current = eligible ? proj!.id : null; // Take a snapshot of the freshly-loaded state — this is the baseline // for dirty detection. Without this, the very first change would fire