Marc-André Bombeck 8fd1d543a6 fix(medications): let a manager end a course and serve End only to who may press it ...

POST /api/medications/{id}/courses/end resolved the caller with
requireAuth(), so a delegate managing the record got 403 while the
medication PUT that used to carry the end date admits MANAGE, and the
reads still served canEndCourse true. The action now resolves the record
at MANAGE over medications and files the previous end (C4) with the
count of tombstoned placeholders.

The medication reads narrow canEndCourse and canStartCourse to the
caller: End needs MANAGE, starting a course stays owner-only. The list
cell stays per record and the narrowing runs after it. Create and edit
answers pass the grant they were resolved under instead of null.

Registered in the sharing surface guard, the MANAGE handler matrix and
the activity feed's verb lines.

Refs #1280

2026-10-25 00:26:55 +02:00

..

e2e-journeys.ts

docs: publish the UI standards in docs/contributing

2026-10-21 19:37:22 +02:00

legacy-account-payloads.ts

test: add sharing security principals

2026-08-05 23:26:42 +02:00

notification-matrix.ts

test: add sharing security principals

2026-08-05 23:26:42 +02:00

security-principals.ts

chore: drop two exports nothing reaches

2026-08-07 10:25:52 +02:00

sharing-matrix.ts

fix(medications): let a manager end a course and serve End only to who may press it

2026-10-25 00:26:55 +02:00