Ruben Fiszel 2bf7746cdd fix: operators cannot archive or delete flows and apps (#10322) ...

`create_flow`/`update_flow` and `create_app`/`update_app` reject operators, but
`archive_flow_by_path`, `delete_flow_by_path` and `delete_app` did not — so an
operator with folder write could delete a flow or app they were not allowed to
edit. Scripts already get this right (archive is guarded, delete is admin-only).

Verified on a live instance: all three returned 2xx for an operator before, 401
after, and a non-operator member with the same folder write is unaffected.

2026-07-26 11:36:33 +02:00

..

flows.rs

fix: operators cannot archive or delete flows and apps (#10322)

2026-07-26 11:36:33 +02:00

lib.rs

chore: split api-scripts and api-flows

2026-02-11 13:27:00 +00:00