vignesh/bottleneckcrm
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(opportunity): fix dead creator check in kanban move RBAC

Browse source 
is_owner compared request.profile (a Profile) to opportunity.created_by (a
User FK), which is never equal, so a non-admin creator who is not also an
assignee was wrongly denied moving their own deal. Compare user ids, matching
the detail-view RBAC.
This commit is contained in:
Rohit10jr 2026-08-10 19:38:13 +05:30
parent 799bb12102
commit 56fe450ab4
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
backend/opportunity/views/kanban_views.py
View file

@ -182,7 +182,7 @@ class OpportunityMoveView(APIView):
# Match Opportunity update/delete RBAC: admin OR creator OR assignee.
if not is_org_admin(request.profile) and not request.user.is_superuser:
is_owner = request.profile == opportunity.created_by
is_owner = request.profile.user_id == opportunity.created_by_id
is_assignee = request.profile in opportunity.assigned_to.all()
if not (is_owner or is_assignee):
return Response(