Issue: Relationship fields allow editing of pieces even without view permissions for related piece types
Issue: Relationship fields allow editing of pieces even without view permissions for related piece types: a task in LegoFlow-SWE (Harbor dataset). When editing a document, relationship fields do not respect the current user's permissions for the connected piece type. Even if a user lacks view…
The task
When editing a document, relationship fields do not respect the current user's permissions for the connected piece type. Even if a user lacks view permission for a specific piece type, they can still add, remove, or change relationships to pieces of that type. This leads to potential information leakage and…
Part of Lego-X/LegoFlow-SWE.