Marc-André Bombeck 8c070c953b feat(sharing): open the mood, custom-metric and record reads to a delegate ...

Six routes: the mood-entry list and detail, the custom-metric list, detail
and entries, and the personal-record list. The custom-metric entries read
establishes ownership on the metric before it queries by metric id, and that
hop now resolves against the record — a delegate cannot reach their own
metric from inside somebody else's account.

`GET /api/mood/tags` stays refused. It looks like plain record vocabulary and
one select in the middle of it pulls the owner's tag layout, which is a
presentation preference and belongs to the person rather than the record.

The mood list's validation breadcrumb moves onto `auditLog()` for the actor
stamp, the same change the measurement reads took.

2026-08-02 16:44:52 +02:00

..

integration

feat(sharing): open the mood, custom-metric and record reads to a delegate

2026-08-02 16:44:52 +02:00