Skip to main content

🐞Bug: User Permissions

Feature Request

I have this problem.

The user previously posteds to a given Profile on various social media platforms.

However, I changed their permissions, and they no longer have access to that Profile.

However, when they visit:

https://getlate.dev/dashboard/posts

They can see what they previously posted (even though they no longer have access to that Profile).

🤔

I would expect that if I revoked their profile access, they would also no longer see their published posts (even though they previously posted).

Otherwise, even though they don't have access, they can still delete posts there.

Posted by Jack S. ·
Status: Completed1 comment

Log in to comment and vote

Comments1

  • Miquel Palet López

    Team•

    Aug 26

    This is fixed. A team member whose profile access has been revoked no longer sees the posts published to that profile's accounts: the post list at /dashboard/posts (and GET /v1/posts) is now scoped to accounts under the profiles they still have access to, including posts they created themselves.

    The same check runs on the single-post routes, so GET, PUT and DELETE /v1/posts/{postId} return access denied for those posts as well, which closes the delete path you flagged. If you still see an old post in a member's list, send us the member and profile and we will look at that account.