cd6fbcd
fix(security): observer role is read-only — block write methods (POST/PATCH/PUT/DELETE) on external_ok routes unless external_write_ok flag is set; observers can still POST comments, chat messages, mark notifications read, revoke sessions
2026-08-23T06:53:27+00:00
Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>