From 56fe450ab4fc396bbb0f58b4c27bbf972c80da38 Mon Sep 17 00:00:00 2001 From: Rohit10jr Date: Mon, 10 Aug 2026 19:38:13 +0530 Subject: [PATCH] fix(opportunity): fix dead creator check in kanban move RBAC is_owner compared request.profile (a Profile) to opportunity.created_by (a User FK), which is never equal, so a non-admin creator who is not also an assignee was wrongly denied moving their own deal. Compare user ids, matching the detail-view RBAC. --- backend/opportunity/views/kanban_views.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/opportunity/views/kanban_views.py b/backend/opportunity/views/kanban_views.py index afcddf5f..d6a40544 100644 --- a/backend/opportunity/views/kanban_views.py +++ b/backend/opportunity/views/kanban_views.py @@ -182,7 +182,7 @@ class OpportunityMoveView(APIView): # Match Opportunity update/delete RBAC: admin OR creator OR assignee. if not is_org_admin(request.profile) and not request.user.is_superuser: - is_owner = request.profile == opportunity.created_by + is_owner = request.profile.user_id == opportunity.created_by_id is_assignee = request.profile in opportunity.assigned_to.all() if not (is_owner or is_assignee): return Response(