arnaudne 169309af05 security: enforce family ownership on all baby-data API routes ...

All collection routes (events, growth, doctor-notes, journal, milestones,
vaccinations, milk, reminders, teeth, search, export) now verify the requested
babyId belongs to the authenticated user's family before querying or writing.
All [id] mutation routes verify record ownership via nested baby→familyId
before any PATCH/DELETE. Additional fixes: admin config masks sensitive
secrets in GET response, invite send-email enforces PARENT role, photo
serving requires authentication, baby PATCH restricted to own-family PARENT.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-06-15 23:22:44 +02:00

..

agent-a31af47fbdb654bea @ 8bb048ff56

security: enforce family ownership on all baby-data API routes

2026-06-15 23:22:44 +02:00