- Shipped
- 6 ஜூலை, 2026 அன்று 7:49 AM UTC
- Author
- Kamo
- Commit
- 07281cd
The enriched /document-requirements read authorized any party to the app and returned EVERY party's requirements, so on a joint loan a borrower saw the co-borrower's rows (per-party boundary leak), got a 403 dead-end clicking their Upload button, and a progress bar that never hit 100%. Borrowers (no LOS_VIEW_PIPELINE) are now filtered server-side to requirements owned by their own account-party; operators still see the whole loan. Fail-closed if the caller's party can't be resolved.