Christophe Vila ad906a10f7 api: add end-to-end cross-user isolation tests ...

HTTP-level counterpart to the store-layer isolation tests: proves the full
middleware+handler chain rejects/hides another user's activities, workout
kinds, and review queue even when given that user's real row ids, and that
an unprovisioned session is blocked from every data route.

2026-07-25 18:33:44 +02:00

5.7 KiB

Raw Blame History

View Raw