- Shipped
- October 18, 2026 at 6:05 PM UTC
- Author
- Kamo
- Commit
- e2b8ff0
Every BinderController route (list, get, create, scratch, update, duplicate, delete, items, reorder, shares, render) took a session alone, so a member without VIEW_DOCUMENTS could list binders, read their items' file names and render them to one PDF. A binder is a view over documents, so each route now takes the right every document read takes, before the service is asked. GET /shares/by-image and /shares/shared-with-me take it too: both list documents that open only with it. No new right: the DocManager that shows binders and shares already needs VIEW_DOCUMENTS to list one document, so nobody who uses those screens today loses them.